GCVE-110-OSM-2026-5754

This package explicitly declares 'edu-npm-postinstall-demo2' as a dependency, which is independently flagged as known malicious. The 'educational' framing is a social engineering cover — the index.js is deliberately innocuous but the package's sole function is to pull in the malicious postinstall dependency on install. The publisher account 'sydney0716' is less than a day old and published 5 versions in under 30 minutes (249 versions/day rate), consistent with an adversary iterating to evade detection, not a genuine educational publisher. No source repository is linked, removing any transparency. The attacker model is dependency-chain poisoning: embed the payload in a child package and use this wrapper as a distributable dropper. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Malicious Dependency Detected in package.json - Brand New Package - Very New NPM Publisher Account - Rapid Version Publishing