GCVE-110-OSM-2026-14087

The package @cap-js/openapi was found to contain malicious code. This package was compromised as part of the ongoing "Mini Shai-Hulud is back" worm by the TeamPCP threat actor. The package will steal credentials and then propogate it to every package it has access to. The package also attempts to remain persistent. ENTRY index.js (main: index.js) DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in lib/compile/diagram.js: "encodeURIComponent(diagram)}.svg" ADDITIONAL FINDINGS - Very New NPM Publisher Account PAYLOAD FILES lib/compile/diagram.js