GCVE-110-OSM-2026-9237

The package presents as a lightweight calendar/streak math utility but ships a single `index.mjs` file that is over 530 KB — extremely large for a 'dependency-free primitives' library. The deobfuscation step was skipped due to the file exceeding the size cap, so the actual content of that file cannot be assessed. A 530 KB minified/bundled file from a brand-new author with no source repository, published via a ProtonMail account with only two packages, warrants manual inspection before any trust is placed in it. The metadata signals (new account, single version, no repository) are individually weak but compound the anomaly of the oversized single-file bundle.