GCVE-110-OSM-2026-9241

Publisher 'shoaib.umt' has a 50% malicious ratio across 14 checked packages, with 7 already reported as malicious in OSM at critical severity — including afterpay-sdk-example-server, dbt-language-server, llm-traces-app, paypal-postman-lib, simplisafe-gatsby, starship-timeline, and twilio-voice-js-reference-components. The account is only 9 days old and has been rapidly publishing packages impersonating well-known brands (TIDAL, Twilio, PayPal, SimpliSafe, dbt, Afterpay), a pattern consistent with a supply-chain typosquatting or dependency confusion campaign. This package follows the exact same profile: brand impersonation name, no description, no repository, single version, published within days of account creation. The publisher history alone is sufficient to attribute this to a serial malicious actor; the package almost certainly carries a similar payload to its siblings. ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages