GCVE-110-OSM-2026-9308

Test-harness package for the distributed multi-package delivery mechanism, published 2026-04-27, one day before the main campaign launch. Describes itself as a data transformation toolkit with remote config loading and expression evaluation - the same remote-config plus expression-evaluation primitive the production cluster abuses. Still live on npm at the time of writing (not unpublished, unlike the rest of the cluster). Published by neural_dev <neural_dev@outlook.com>, 2026-04-27T09:28:45Z. tarball sha1 ab568ba2aebe66c216f8634402d4778070b5f6bf Stated feature set: 'remote config loading and expression evaluation'. Delivery chain: npm package -> .cloud-preferences.json rules (stage 2, Node vm sandbox escape via items.constructor.constructor -> F('return process')()) -> setting.js (stage 3, platform fingerprinting) -> aone-cli (stage 4, cross-platform RAT).