GCVE-110-OSM-2026-7836

The package is a brand-new, single-version GitHub repo with a thin index.js that simply re-exports from 'base58-core', which could itself be a malicious or typosquatted dependency. The chai-max-wallet-theft rule fired, but the only match was the string 'Solana wallet' in package.json description — this is likely a regex false positive on thematic text rather than actual wallet-theft code. No exfil endpoints, obfuscation, network calls, or credential-theft patterns are visible in the entrypoint. The real risk is the unresolved 'base58-core' dependency — if that package is malicious, this repo is a delivery wrapper; the absence of content here is itself a weak concern worth verifying. ENTRY index.js (default-index: index.js) ADDITIONAL FINDINGS - Chai-Max Wallet Theft Indicators in package.json: "Solana wallet"