GCVE-110-OSM-2026-5892

This package implements a classic supply-chain dropper pattern. The IOC `http://attackers-server/tastytreats-1.0.0.tgz?yy=\`npm` embedded in the package.json operational field (classified as C2) reveals an install-time hook that fetches and likely executes a remote tarball from an attacker-controlled server, with the backtick syntax suggesting shell command injection to capture npm context. The entrypoint `index.js` contains an obfuscated string fragment `'lci5jb20vYWphe'` concatenated with arbitrary input, consistent with a partial base64-encoded URL being assembled at runtime to evade static detection. The publisher `mangalak` has an already-confirmed malicious package (`opensearch-genai-observability-sdk-ts`, OSM threat 326a0224) in their portfolio, indicating a repeat threat actor. Single version, no linked repository, and a nonsensical Zen-koan description further confirm this is not a legitimate utility package. ENTRY index.js (main: index.js) DESTINATION - urls: http://attackers-server/tastytreats-1.0.0.tgz?yy=`npm (c2, plaintext) ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages