GCVE-110-OSM-2026-13622

The publisher 'hissakdx92' has a malicious ratio of 0.33 with two previously confirmed malicious packages (css-flow-reading-polyfill, css-logical-flow-polyfill) already reported in OSM. The account is only 7 days old and this package is a placeholder ('0.0.0-stage') with no source repository, no downloads, and a description suggesting staged publishing — a pattern consistent with dependency confusion or supply chain staging attacks targeting Wix/Thunderbolt infrastructure (inferred from package naming). There is no code to analyze directly (null entrypoint/exfil), so the verdict rests entirely on publisher reputation and metadata signals. The combination of a brand-new account, confirmed-malicious sibling packages, and a placeholder targeting a recognizable internal namespace warrants elevated scrutiny. ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages