GCVE-110-OSM-2026-13626

This package is a brand-new placeholder published by a 7-day-old account (hissakdx92) with no source repository, no downloads, and a staging version string (0.0.0-stage). The publisher has 7 packages total, all with CSS polyfill or Wix/Thunderbolt-related names, which may indicate a dependency confusion attack targeting internal Wix/Thunderbolt build tooling — those internal names published externally is a classic dependency confusion pattern. There are no code-level findings, no IOCs, and no entrypoint content to analyze, so the threat cannot be confirmed from static analysis alone. The combination of a new account, staged placeholder, Wix-internal-sounding names, and no legitimate purpose warrants monitoring.