GCVE-110-OSM-2026-5919

This package is a coordinated dependency-confusion/typosquatting campaign targeting organizations that consume the legitimate `@patternfly` ecosystem. The publisher `modukpoc@sl4x0.xyz` — a brand-new account (~117 hours old at publish time) using a known-suspicious `.xyz` TLD — published four packages all squatting the `@patternfly-4` pseudo-scope, which is Levenshtein-close to the real `@patternfly` scope. The version `9.9.9` is a textbook dependency-confusion inflation designed to shadow internal packages. On load, `index.js` immediately and silently executes `lib/compat.js` via a try/catch that swallows all errors — a classic payload-hiding technique — and `lib/compat.js` contains an escaped protocol pattern consistent with URL construction in obfuscated exfil code. The presence of install hooks compounds the risk: the payload can run before the module is even imported. The attacker model is dependency confusion: an enterprise CI/CD system resolving `@patternfly-4/react-tokens` against the public registry would pull this package, trigger the install hook, and silently execute `lib/compat.js`. ENTRY index.js (main: index.js) INDICATORS (IOCs) - emails: security@enterprise-tools.io, engineering@enterprise-tools.io