GCVE-110-OSM-2026-9494

Poses as a data-formatting library but contains zero formatting logic — the entire package is a second-stage dropper. The preinstall hook unconditionally executes index.js, a hidden PowerShell cradle that downloads https://files.catbox.moe/5khq55.zip, extracts it, and launches the EXE via child_process.exec. Identical payload URL and TTP to mcp-audit-sync-internal@99.9.9 — same operator/kit SHA-256 of package tarball: b21a657cfe840535529cdd6616c91f35bcc5ecffe03d7c31dbef93b5b65d8cb6 index.js (sole package content) builds and executes a PowerShell command with a hidden window to download the catbox.moe ZIP, extract it, and run the embedded EXE. Install-time remote code execution with user privileges; payload is server-controlled and can be swapped at will