GCVE-110-OSM-2026-13267

Publisher 'naorya' has a confirmed malicious package (css-eqxcdx-polyfill) already flagged in OSM, and this package is part of a cluster of similarly named css-*-polyfill packages published from the same brand-new account (account age ~0.58 days). The naming pattern — randomized 6-character slugs like css-xunhaj-polyfill, css-eqxcdx-polyfill, css-fxgiix-polyfill — is consistent with a dependency confusion or typosquatting campaign deploying placeholder packages across a namespace. No code-level findings are present (entrypoint and exfil are null), so the current version appears to be a staged placeholder with no active payload, but the publisher context strongly indicates adversarial intent. The @naorya/registry-override-repro package name further signals deliberate registry manipulation research or attack. ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Has Other Malicious Packages