GCVE-110-OSM-2026-9291

The publisher 'richswift225' has a publisherMaliciousRatio of 1.0 — their only other checked package 'peptide-score' is already flagged as critical malicious in OSM. This package depends on 'js-unimode', which is independently confirmed malicious by OpenSourceMalware.com. The combination of a known-bad publisher and a known-bad dependency establishes a clear supply-chain attack pattern: the surface-level code in index.js appears legitimate (peptide modification logic), but the malicious payload is delivered through the 'js-unimode' dependency. The dynamic code execution finding (regex.exec) in index.js appears to be a legitimate regex use, but the overall attacker model is clear — a threat actor operating multiple malicious packages using poisoned dependencies to deliver payloads. ENTRY index.js (main: index.js) ADDITIONAL FINDINGS - Malicious Dependency Detected in package.json - Dynamic Code Execution in index.js: "exec(string)" - Publisher Has Other Malicious Packages PAYLOAD FILES index.js