GCVE-110-OSM-2026-13619

The publisher 'hissakdx92' is a 7-day-old account with 2 of 7 packages already flagged as malicious in OSM (css-flow-reading-polyfill, css-logical-flow-polyfill), yielding a malicious ratio of ~0.29 — meaningful signal for a brand-new account. The package itself is a placeholder ('0.0.0-stage') with no source repository, no entrypoint, and no code-level findings, which could indicate staged infrastructure being positioned for a future payload drop. The naming pattern — impersonating Wix Thunderbolt internals ('wix-tb-elements-ssr-utils') alongside the other packages mimicking polyfill conventions — is consistent with a dependency confusion or typosquatting campaign. Without code-level findings or IOCs, malicious cannot be confirmed, but the publisher reputation and package positioning warrant monitoring. ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages