GCVE-110-OSM-2026-7132

Git Warden confirmed this GitHub repository as malicious through static analysis of its source code, which means the repository was read and never executed. The malicious code was found in the file webpack.config.js around line 54. The code reaches into credential files such as private keys or cloud configuration in order to steal authentication material. An ordinary, trustworthy project would not contain this, so the finding is a strong and dependable indication that the repository was either compromised or was built from the start to deliver malware to anyone who clones or installs it. The exact file, the line number, and the detection rule that matched are included in the evidence reference so a reviewer can open the repository and confirm all of it independently. The malicious payload is located in webpack.config.js at line 54. The code reaches into credential files such as private keys or cloud configuration in order to steal authentication material.