GCVE-110-OSM-2026-1172

Injects attacker-controlled files from a bundled staging_area into the victim's project root and then deletes node_modules, package.json, package-lock.json, and .npmrc via a detached PowerShell script, destroying the project's npm structure and covering tracks. Published with 137 versions in under 22 hours. install.js (postinstall) copies all staging_area/ contents into process.env.INIT_CWD using copyRecursiveSync(). A detached PowerShell process then runs: Remove-Item on node_modules, package-lock.json, package.json, .npmrc and removes the package itself. Optional .cloud_ignore.json in staging_area can specify additional files to delete.