GCVE-110-OSM-2026-5999

The assignment `global['r'] = require` in `lib/schema/bootstrap.js` is a textbook obfuscation bootstrapping pattern used to alias `require` to a short computed global property, enabling subsequent obfuscated code to call `global['r']('child_process')` or similar without triggering naive regex scanners. There is no legitimate reason for a TypeScript validation library to use this pattern. This is compounded by the presence of `require('child_process')` in the package.json install scripts, indicating shell execution is triggered at install time. The package was published by a brand-new single-package Gmail-based account three days ago, exhibiting a classic threat actor profile. While `eslint-config-prettier` and `eslint-plugin-prettier` are normally legitimate packages and the malicious-dependency flags may reflect version-specific hijacks or OSM false positives, the code-level obfuscation and install-hook execution are sufficient to establish adversarial intent independent of the dependency flags. ADDITIONAL FINDINGS - Global Require Alias in lib/schema/bootstrap.js: "global['r'] = require" - Shell Command Execution in package.json: "require('child_process')" - Malicious Dependency Detected in package.json PAYLOAD FILES lib/schema/bootstrap.js INDICATORS (IOCs) - payloadFileHash: 14b2a9bcc5a811ffaa9d086797a62f5e5ff828c9685fd9994d39a16d32ed3c8b