GCVE-110-OSM-2026-5911

This package is part of a coordinated malicious campaign by publisher 'shivamkalsi2024', who has 8 other packages already confirmed malicious in OSM. The package explicitly depends on multiple known-malicious packages: @oraliepham/api-chat-fanpage-facebook, @oraliepham/api-facebooknew, @teamteanpm2024/earum-illum-veniam, @teamteanpm2024/earum-ipsam-aspernatur, api-chat-fanpage-facebook, api-chatfb, and api-chatfb-test — all flagged in OSM. The attacker model is a supply-chain propagation approach: the wrapper package pulls in known-bad dependencies to ensure malicious code executes even if the wrapper itself appears clean. The package description is a deliberately obfuscated HTML comment ('<!--'), the entrypoint contains only timestamp comments and Lorem-ipsum-style gibberish prose, and the package has a security holding flag — all consistent with a throwaway distribution vehicle for malicious dependency chains. ENTRY lib/index.js (main: index.js) ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages - Malicious Dependency Detected in package.json INDICATORS (IOCs) - urls: https://app.gitter.im/#/room/#stdlib-js_stdlib:gitter.im, http://www.json.org/ - domains: app.gitter.im, gitter.im, www.json.org