GCVE-110-OSM-2026-9416

This package self-identifies as a security research placeholder in its description, published by capsule.security (bar@capsule.security), which is a known security research firm that publishes dependency confusion probes. The package name 'mlflow-skinet' appears to be a dependency confusion test targeting a potential internal package name. No malicious code was found — the static score is clean with only metadata signals. Per the boundary rules for bug bounty/dependency confusion test packages, this warrants a suspicious verdict rather than malicious, and should not be submitted to OSM. No malicious payload for this PoC