GCVE-110-OSM-2026-5834

The publisher 'lobohunter' has a publisherMaliciousRatio of 1.0, meaning every previously checked package from this account (ttspc-server-sample, OSM threat id 59ba1fba-2585-4514-901e-e63092cb534b) was confirmed malicious. Three versions were pushed within roughly 38 minutes on the day of account creation, a rapid-version-spam pattern consistent with adversarial iteration to evade detection. The package claims to be a Cloudflare Workers build tool but has no source repository, no download history, and was published by a brand-new account using a disposable-looking email domain (dyleris.com). While no code-level exfiltration or obfuscation findings were captured in this scan, the totality of metadata signals — confirmed-malicious publisher, throwaway email, version spam, zero provenance — is consistent with a supply-chain implant masquerading as a legitimate build tool. Key findings: - Publisher Has Other Malicious Packages - Rapid Version Publishing