GCVE-110-OSM-2026-14198

This package implements a textbook NuGet supply-chain attack. The MSBuild targets file auto-executes `tools/payload.ps1` via a `BeforeTargets="Build"` hook on every consumer build, using `-ExecutionPolicy Bypass` to suppress PowerShell's safety guardrails. The script is literally named `payload.ps1` — not a build helper, not a test runner — and contains non-Latin (Arabic/Farsi/Urdu) script content, consistent with comment-based obfuscation or attacker attribution. The target is deceptively named `DepwatchTelemetry` to blend in as legitimate instrumentation. The publisher `blazo111` has four packages all using similar env-config theming (EnvParse.Kit, DotEnv.Lite, Hardhat.Env, Mcp.EnvTools), consistent with a coordinated campaign seeding multiple plausible-sounding library names. Static analysis did not recover payload.ps1 content or network IOCs, so confirmed exfil endpoints cannot be listed, but the mechanism — a disguised build hook auto-running a file explicitly named 'payload' with policy bypass — is unambiguous in intent. ENTRY build/Mcp.EnvTools.targets (nuget-build-hook: build/Mcp.EnvTools.targets) ADDITIONAL FINDINGS - MSBuild Exec Task in build/Mcp.EnvTools.targets: "<Exec Command="powershell" - Brand New Package PAYLOAD FILES build/Mcp.EnvTools.targets