GCVE-110-OSM-2026-12713

package.json declares a dependency `test-supply-npm-git-prepare-proof-4` whose value is a bare git URL (`git+https://git@github.com/agustedone/test-supply-npm-git-prepare-proof-4.git`) rather than a registry version range. On `npm install`, npm clones that repository at mutable HEAD and runs any lifecycle scripts (preinstall/install/postinstall/prepare) it contains, with no version pin, no commit SHA, and no integrity check. Whoever controls the referenced GitHub repository controls code that executes on the installer's machine at install time. The shipped package body is otherwise an inert stub — the manifest line itself is the delivery mechanism. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "test-supply-npm-git-prepare-proof-4": "git+https://git@github..." ADDITIONAL FINDINGS - Brand New Package - Publisher Shows Burner-Account Pattern - Rapid Version Publishing