GCVE-110-OSM-2026-13624

The publisher 'hissakdx92' is a brand-new account (7 days old) that has published 7 packages in a short burst, all following a similar naming pattern centered around CSS polyfills and Wix/Thunderbolt internal naming conventions (e.g., 'wix-tb-css-scope-polyfill', 'thunderbolt-element-grid-reader'). This pattern is consistent with a dependency confusion attack targeting Wix's internal package namespace. The package itself is a placeholder ('0.0.0-stage', description says 'staged publishing') with no source repository, no code findings, and no downloads — so there is nothing malicious confirmed in the code, but the metadata pattern warrants attention. The combination of a new account, no prior malicious packages confirmed yet, internal-looking package names, and 'stage' versioning without a public repo makes this suspicious enough to flag for manual review.