GCVE-110-OSM-2026-9111

The package itself is a straightforward, well-structured ESLint config with no malicious code in index.js — it is a normal shareable config for React/TypeScript projects. The only concerning signals are two dependency flags marking 'eslint-config-prettier' and 'eslint-plugin-prettier' as known malicious per OpenSourceMalware.com. These are extremely widely-used, legitimate packages (hundreds of millions of downloads), so the OSM flags likely reflect either a false positive in the database, a specific compromised version pinned in this package, or stale/erroneous intelligence. The package itself has no exfiltration, obfuscation, install hooks, or network behavior. The publisher has 15 packages, zero prior malicious ratio, and a credible organizational scope (@g123jp). Without knowing which specific versions of those dependencies are flagged and whether this package pins a known-bad version, the verdict must remain suspicious rather than benign purely due to the dependency intelligence. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Malicious Dependency Detected in package.json INDICATORS (IOCs) - urls: https://eslint.org/, https://eslint.org/docs/developer-guide/shareable-configs, https://classic.yarnpkg.com/en/docs/cli/link - domains: eslint.org, classic.yarnpkg.com