GCVE-110-OSM-2026-9415

This package self-identifies as a security research placeholder with contact bar@capsule.security, which is consistent with a dependency confusion or namespace squatting test by capsule.security, a known security research firm. The package performs no malicious action and has zero code-level findings, but it is a brand-new single-version package with no source repository, published under an account with only two such placeholder packages. Per adjudication guidelines, security test packages that self-identify should be treated as suspicious-but-benign rather than malicious, and should not be submitted to OSM to avoid polluting the database.