GCVE-110-OSM-2026-9509

The package wraps shell command execution with cross-platform support (cmd.exe on Windows, bash on Unix) and uses windowsHide:true to suppress process output windows, which is a stealth pattern but also common in legitimate CLI helper libraries. The os.platform() call is used to branch execution logic rather than for exfiltration — no network calls, no webhook IOCs, no credential reads, and no exfil path were identified. The minimal metadata (no description, no repo, no author) and the 'test-dev-exec' name suggest an unpublished internal tool or experiment rather than a deliberate typosquat. Without evidence of data collection being transmitted anywhere, this reads as a low-confidence suspicious case driven primarily by metadata gaps and a stealth-adjacent exec wrapper. ENTRY src/index.js (main: ./src/index.js) EXFIL - System Information Collection in src/command.js: "os.platform()" ADDITIONAL FINDINGS - Silent Process Execution in src/command.js: "windowsHide: true" - Shell Command Variable Setup in src/command.js: "win32"; const cmd = isWin ? `cmd /c ${command}` : command; const child = exec(cm..." PAYLOAD FILES src/command.js