GCVE-110-OSM-2026-14404

task-runner-testmetest was published by the 'testmetest' Miasma-family worm operator (npm account unknown) as part of a public test cluster. SafeDep observed only 0.0.0-stage stub and/or 1.0.0 decoy versions (benign or unknown); the operator's pattern is stub -> decoy -> armed patch version. No malicious version observed. Operator-controlled package name in the testmetest worm cluster; sibling packages carry a binding.gyp / native-addon loader for a credential-stealing worm with exfil fallback hxxps://aiarmor[.]website/v1/api and a token-revocation wiper. Removed from npm (unpublished or replaced with 0.0.1-security).