GCVE-110-OSM-2026-13623

The publisher hissakdx92 has a malicious ratio of 0.33 with two previously reported malicious packages (css-flow-reading-polyfill, css-logical-flow-polyfill) under the same account, which is a meaningful adversarial signal. The package names across this publisher's portfolio suggest deliberate namespace squatting around CSS polyfill and Wix/Thunderbolt terminology, consistent with a dependency confusion or typosquatting campaign targeting Wix/web platform developers. The package itself is a placeholder ('0.0.0-stage') with no entrypoint or exfil content available, meaning no code-level confirmation of malicious behavior can be made at this version. However, the publisher's track record and the staged placeholder pattern (possibly pre-positioning for a malicious payload in a future version) warrants elevated scrutiny rather than dismissal. ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages