GCVE-110-OSM-2026-5274

This package follows a classic supply-chain concealment pattern: the entrypoint (dist/index.cjs) is a completely innocuous dummy logger with no suspicious code, but the package pulls in 'obfus-jsxy' — a dependency whose name signals obfuscation and is independently confirmed malicious in the OSM database. The publisher has a single package, no source repository, and a newly created account, fitting the throwaway-publisher model used in dependency poisoning campaigns. Entrypoint: dist/index.cjs (main: ./dist/index.cjs) Key findings: - Malicious Dependency Detected (OSM) in package.json: obfus-jsxy and ts-logger-pack - The domain 'fleet-trout-946.convex.site' (recovered as '2Ffleet-trout-946.convex.site') appears to be an attacker-controlled Convex backend endpoint likely used for exfiltration by the malicious dependency. IOCs: - domains: 2Ffleet-trout-946.convex.site