GCVE-110-OSM-2026-9242

Publisher 'shoaib.umt' has a 50% malicious ratio across 14 checked packages, with 7 confirmed malicious packages including multiple critical-severity entries (dbt-language-server, llm-traces-app, paypal-postman-lib, simplisafe-gatsby, starship-timeline, twilio-voice-js-reference-components). This account was created only 9 days ago and is operating as a prolific threat actor publishing squatted/impersonation packages at scale. The current package 'triage_bot_using_sdkv3' fits the same pattern: single version, no metadata, no repository, newly published — consistent with the throwaway/campaign shape seen across the publisher's other malicious packages. While no code-level IOCs were recovered in this scan, the publisher history alone constitutes strong evidence of adversarial intent, and the absence of code findings likely reflects an incomplete extraction rather than a clean package. ADDITIONAL FINDINGS - Publisher Has Other Malicious Packages