GCVE-110-OSM-2026-9112

The primary concern is the flagged 'malicious-dependency' finding against 'axios', which OSM has flagged as malicious. However, axios is an extremely widely used HTTP client and the flagging may reflect a specific compromised version or a false positive in the OSM database rather than the axios dependency used here. The package itself appears to be a legitimate SDK for the CTW BOX platform — it has a consistent version history spanning over a year, an established publisher with no prior malicious packages, and the entrypoint code is clean TypeScript-compiled boilerplate with no obfuscation, no exfil patterns, and no suspicious network calls. The IOCs (ctwbox.stg.g123.jp) are classified as passive and consistent with a legitimate staging API endpoint for the ctw.inc organization. The missing source repository is a minor concern but not indicative of malice given the internal corporate SDK nature of the package. ENTRY dist/src/index.js (main: dist/src/index.js) ADDITIONAL FINDINGS - Malicious Dependency Detected in package.json INDICATORS (IOCs) - urls: https://ctwbox.stg.g123.jp/api/v1, https://ctwbox.stg.g123.jp/?link_id=3c7d6e9ecb0a4ac9ab9aedfa0035232d - domains: ctwbox.stg.g123.jp