GCVE-110-OSM-2026-12559

This repository is part of a GitHub Actions-based download inflation farm operated by the Graphalgo campaign. Repositories in this farm run automated workflows on every push that decrypt an AES-256-GCM-encrypted target list (key: `npm_workvr_protect_key_v1`, embedded in a bundled WASM file with MD5 `91e020c13cb97a6365135b53b0d0fe5f`), resolve npm tarball URLs for the campaign's malicious packages, and download each one a specified number of times at one-second intervals — discarding the bytes immediately. This manufactured download traffic (tens of millions of downloads per package) was used to make newly published malicious packages appear popular and trustworthy. All repositories receive byte-identical `commands.json` pushes from a central orchestrator.