GCVE-110-OSM-2026-784

Malicious test/proof-of-concept package with obfuscated naming. Supply chain attack demonstrating page object pattern exploitation with MSBuild code execution. Exploits NuGet's MSBuild integration by placing malicious code in .targets files as inline tasks. When projects build, MSBuild automatically imports and executes these tasks, downloading .NET executables from throwaway GitHub repositories with embedded obfuscated command-line payloads.