GCVE-110-OSM-2026-14552

Part of a self-republishing campaign: generated names of the form <adjective>_<animal>_<colour>-<number>, each package shipping the same autopublish.js, which runs `npm publish --access public` to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 3.4.3; tarball SHA-256 cdf7bcc56962d977f34fdb72789ce2b6aaac0020f0debb9ce4d55de8257ac352. ENTRY autopublish.js (main: autopublish.js) OBFUSCATION - String Array Obfuscation in autopublish2.js: "["apple", "banana", "orange", "pear", "strawberry", "kiwi", "pineapple", "waterm..." ADDITIONAL FINDINGS - Shell Command Execution in autopublish.js: "require('child_process')" PAYLOAD FILES autopublish2.js (+ autopublish.js, autopublish3.js)