GCVE-110-OSM-2026-9343

This package claims to be the GitHub Actions toolkit core library but is published by a third-party npm account (sourav_chanduka) with only 3 packages, all of which spoof the official @actions/core namespace. The repository URL points to the legitimate actions/toolkit repo, which is a classic squatting/impersonation indicator. The package has a security holding flag that was recovered, suggesting it was previously flagged by npm. The single finding — reading ACTIONS_ID_TOKEN_REQUEST_URL from the environment in oidc-utils.js — is consistent with the legitimate @actions/core functionality, but in the context of an impersonator package this raises the risk that the library is harvesting GitHub Actions OIDC tokens. The entrypoint code appears largely consistent with the real @actions/core source, but the presence of a sibling package (@sourav_chanduka/core) and the security holding indicate this warrants manual review. ENTRY lib/core.js (main: lib/core.js) EXFIL - Environment Variable Exfiltration in lib/oidc-utils.js: "process.env['ACTIONS_ID_TOKEN_REQUEST_URL']; if (!runtimeUrl) { throw new Error(..." PAYLOAD FILES lib/oidc-utils.js