GCVE-110-OSM-2026-13387

The OpenSSF Package Analysis project identified 'kmf-vendor-pack' @ 99.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. ENTRY index.js (main: index.js) - Postinstall Script in package.json: ""postinstall": "node -e \"" DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in package.json: ".oast.pro" - Suspicious Domain in package.json: "https://db4fe7a2e2lvaraia8k0n4amgw4ir83az.oast" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing