GCVE-110-OSM-2026-14560

Part of a self-republishing campaign: generated names of the form <adjective>_<animal>_<colour>-<number>, each package shipping the same autopublish.js, which runs `npm publish --access public` to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 2.4.1; tarball SHA-256 3f547db278b249244788b7b77fef67286b74bf08baf45514c6d2480fa1671ce7. ENTRY autopublish.js (main: autopublish.js) OBFUSCATION - String Array Obfuscation in autopublish2.js: "["apple", "banana", "orange", "pear", "strawberry", "kiwi", "pineapple", "waterm..." ADDITIONAL FINDINGS - Shell Command Execution in autopublish.js: "require('child_process')" PAYLOAD FILES autopublish2.js (+ autopublish.js, autopublish3.js)