GCVE-110-OSM-2026-14556

Part of a self-republishing campaign: generated names of the form <adjective>_<animal>_<colour>-<number>, each package shipping the same autopublish.js, which runs `npm publish --access public` to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 2.2.3; tarball SHA-256 b524996b7179cbc2702ad62f3d2917241f9cf8ad5d559202eac825ebd7cd9844. ENTRY autopublish.js (main: autopublish.js) OBFUSCATION - String Array Obfuscation in autopublish2.js: "["apple", "banana", "orange", "pear", "strawberry", "kiwi", "pineapple", "waterm..." ADDITIONAL FINDINGS - Shell Command Execution in autopublish.js: "require('child_process')" PAYLOAD FILES autopublish2.js (+ autopublish.js, autopublish3.js)