GCVE-110-OSM-2026-5273

This package exhibits a textbook malicious npm package profile: a burner gmail account ('hotmcdonaldpro@gmail.com') publishing a single, version-bumped (4.5.0 — implying history that doesn't exist), zero-metadata package that claims to be an auth middleware but contains only heavily obfuscated code. The index.js is a single-line 18,249-character obfuscator.io-style blob featuring string array rotation (the while(!![]){try/catch/push/shift} idiom), hex-encoded property lookups, and control flow flattening — none of which are patterns found in legitimate auth middleware. Within the obfuscated code, internal module IDs 0x359 and 0x380 definitively resolve to `require('os')` and `require('fs')`, indicating system profiling and filesystem access hidden inside the obfuscation layer. The deobfuscator safety guard was tripped, preventing full analysis of the exfil mechanism, but the combination of burner publisher, false version history, extreme obfuscation, and OS/filesystem access in a package marketed as auth infrastructure is consistent with a credential/environment harvesting dropper — likely part of the supply-chain confusion or typosquatting attacker model targeting CI/CD environments. Entrypoint: index.js (main: index.js)