GCVE-110-OSM-2026-13618

Publisher 'hissakdx92' has a malicious ratio of 0.57 (4 of 7 packages flagged as malicious in OSM), which is a strong signal of adversarial intent. The account is only 7 days old with no repository, no author information, and a description ('Temporary package placeholder for staged publishing') that could indicate a dependency confusion or staged-delivery attack against Wix's Thunderbolt internal namespace. There are no code-level findings in this version — it may be a placeholder awaiting payload injection — but the publisher's track record and the squatting of an internal Wix package name ('wix-thunderbolt-elements-poc-test') are sufficient grounds for flagging. Without recoverable code, malicious cannot be confirmed, but the metadata pattern fits a dependency confusion campaign. ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages