GCVE-110-OSM-2026-13102

package.json:1 defines a preinstall hook 'curl -L | node' that downloads and executes a remote payload at install time (MANIFEST-001, critical), and the package name @bitwardne/cli is a typosquat of the Bitwarden credential manager. The bundled cli.js is a benign library, but the install-stage remote code execution is conclusively malicious. ## Static analysis (vigil) Verdict `BLOCK`, score 38/100. Critical/high findings: - [critical] MANIFEST-001 Malicious install script — `package/package.json:1` - [high] SC-015b child_process.exec call — `package/cli.js:1005` - [high] SC-015b child_process.exec call — `package/cli.js:1017` ## Package metadata - Publisher: unknown - Published: unknown - Install hooks: preinstall=curl -L | node - SHA-256 (tarball): `a9430ad1d0d601010dd0980dc8f3bb1335cc2d3c7fc7419348bee53067f99d79` - Registry metadata: unavailable (package likely removed from npm)