GCVE-110-OSM-2026-53

The publisher 'gravito2025' has a 100% malicious ratio across their checked packages — their only other published package, @easytipsportal/node-helper, is already confirmed critical malicious in OSM. This same-namespace pattern (a 'legitimate' adapter library alongside a known malicious helper) is a common supply chain attack technique where the clean-looking package establishes trust or is later updated to import the malicious sibling. The entrypoint code itself appears to be a genuine POS adapter library (Clover, Square, Foodics, Omnivore OAuth wrappers), and the encodeURIComponent finding is a false positive. However, the axios 'malicious-dependency' flag warrants scrutiny — if a specific compromised version of axios is pinned in package.json, that would be the delivery vector. The account is 72 days old with no dependents and no source repository, consistent with a freshly created supply chain attack identity. ENTRY dist/index.js (main: dist/index.js) EXFIL - Data Encoding for Exfiltration in dist/adapters/base/base.adapter.js: "encodeURIComponent(cursor)}` : baseUrl" ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Malicious Dependency Detected in package.json PAYLOAD FILES dist/adapters/base/base.adapter.js INDICATORS (IOCs) - urls: https://www.clover.com/oauth/v2/authorize, https://api.clover.com/oauth/v2/token, https://api.clover.com/oauth/v2/refresh, https://sandbox.dev.clover.com/oauth/v2/authorize, https://apisandbox.dev.clover.com/oauth/v2/token (+14 more) - domains: com.gravito.tender.online, www.clover.com, api.clover.com, sandbox.dev.clover.com, apisandbox.dev.clover.com (+5 more) - payloadFileHash: 48ec83ee62073a7ecf8b41ae19afb29e1e29ebe6f12cb53611cd6f299ac7012b