GCVE-110-OSM-2026-13621

Publisher hissakdx92 has a malicious ratio of 0.33 with two already-reported malicious packages (css-flow-reading-polyfill, css-logical-flow-polyfill) from a 7-day-old account publishing 7 packages in a burst — a pattern consistent with a dependency confusion or typosquatting campaign targeting Wix/Thunderbolt infrastructure. The package name 'wix-tb-css-scope-polyfill' mimics a plausible internal Wix Thunderbolt CSS polyfill, and the cluster of similarly named packages (css-nesting-scope-polyfill, css-scope-nesting-polyfill, thunderbolt-element-grid-reader) suggests systematic namespace squatting. No code-level findings are present, but this may be a staged placeholder awaiting payload injection, consistent with the '0.0.0-stage' version tag. The elevated publisher malicious ratio is the dominant signal here and warrants caution pending further investigation. ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages