GCVE-110-OSM-2026-6482

Hijacks the chalk package namespace to deliver install-time malware by impersonating legitimate Nodemailer author Andris Reinman and bundling a 4-vector C2 dependency arsenal (socket.io-client, axios, request, sqlite3) inconsistent with a color utility. The package is 30x the size of legitimate chalk and was deleted from the npm registry. Attributed to the DeceptiveDevelopment threat actor feed with high confidence. Trigger: install-time — install scripts execute unconditionally at npm install. Impersonation: author field claims 'Andris Reinman' (real Nodemailer author) and dev-dependency list is stolen wholesale from the Nodemailer ecosystem to appear legitimate. C2 Arsenal: dependencies include socket.io-client (WebSocket C2), axios and request (HTTP exfiltration), and sqlite3 (native binary dropper for second-stage staging). Size anomaly: 859 KB vs legitimate chalk ~28 KB (30x). Tarball is unrecoverable from npm registry and replicate.npmjs.com; exact payload contents are unconfirmed. Proof class P3 (metadata-only).