GCVE-110-OSM-2026-13268

Publisher 'naorya' is a brand-new account (less than a day old) that has already had one package (css-eqxcdx-polyfill) flagged as malicious in OSM. This package is one of at least eight nearly identical 'css-*-polyfill' placeholders published in rapid succession by the same account, a pattern consistent with dependency confusion or staged-payload infrastructure. The package description ('Temporary package placeholder for staged publishing') is itself a red flag, as it openly acknowledges a staging/deployment intent. No code findings are present to confirm active malicious payload in this specific version, but the publisher's behavior and sibling packages warrant escalation. ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Publisher Has Other Malicious Packages