GCVE-110-OSM-2026-14561

Part of a self-republishing campaign: generated names of the form <adjective>_<animal>_<colour>-<number>, each package shipping the same autopublish.js, which runs `npm publish --access public` to publish the package again. Self-replicating publication is the propagation step of a registry worm and fills the registry with copies. Version examined: 4.3.3; tarball SHA-256 d3d633c35cdfcf07a34516e2f1d6a1761c15d4e5b0769b0fb55117520cc90225. ENTRY autopublish.js (main: autopublish.js) OBFUSCATION - String Array Obfuscation in autopublish2.js: "["apple", "banana", "orange", "pear", "strawberry", "kiwi", "pineapple", "waterm..." ADDITIONAL FINDINGS - Shell Command Execution in autopublish.js: "require('child_process')" PAYLOAD FILES autopublish2.js (+ autopublish.js, autopublish3.js)