GCVE-110-OSM-2026-2546

Dependency confusion package squatting on Walmart's internal npm namespace, part of a multi-target campaign by confirmed malicious actor realvivek07 (vivekkashyap0707@gmail.com). Sibling packages from the same account (paysafe-venmo@99.99.2, paysafe-apple-pay@99.99.2) carry postinstall hooks that exfiltrate USERPROFILE and APPDATA environment variables via HTTPS — those packages were seized by the npm security team. walmart-internal from the same publisher account is separately confirmed in OSM. The package accumulated 111 weekly downloads before removal, indicating successful resolution by real Walmart build systems. **Mechanism:** Dependency confusion namespace occupation targeting Walmart's internal package namespace. The package is a 239-byte stub (3 files): `index.js` exports an empty object, no install scripts, no dependencies. Any Walmart CI/CD pipeline resolving `walmart-core` from the public registry instead of a private registry installs this stub silently. **Actor campaign:** The publisher (vivekkashyap0707@gmail.com / realvivek07) operates 30+ packages in a multi-target dependency confusion campaign against Walmart, Comcast, and Paysafe. Confirmed payload behavior from sibling paysafe-venmo@99.99.2: a postinstall hook collects `USERPROFILE`, `APPDATA`, and OS-level environment variables and exfiltrates them via HTTPS. The paysafe-* packages used version 99.99.2 to ensure resolution priority over private registry pins. **Timeline:** walmart-core@1.0.0 was published 2026-04-11, one day before the paysafe-* payload versions (2026-04-12). 111 weekly downloads indicate the namespace was actively resolved by Walmart build infrastructure before the package was removed.