GCVE-110-OSM-2026-8909

This package declares a dependency on 'streak-calendar', which is confirmed malicious in the OSM database with two independent rule hits (malicious-dependency-osm and malicious-dependency). A package that bundles a known-malicious dependency as a declared dependency will deliver that malware to any consumer who installs it, making the attacker model a supply-chain poisoning via transitive dependency.