GCVE-110-OSM-2026-9110

The package itself is a simple, readable Recoil state observer React component with no malicious code in its entrypoint — the logic is entirely benign (snapshot logging and a local window.postMessage for devtools). However, two of its dependencies (eslint-config-prettier and eslint-plugin-prettier) are flagged as known malicious by OpenSourceMalware.com. These are dev dependencies commonly used in build tooling, and the flagging may be stale or erroneous given how widely used those packages legitimately are, but the OSM flags cannot be dismissed without further verification. The package itself poses no direct threat based on the code, but the dependency flags warrant investigation before clearing. ENTRY dist/index.cjs.js (main: dist/index.cjs.js) ADDITIONAL FINDINGS - Malicious Dependency Detected in package.json