Add malicious npm package dependency_confusions

[tolgaergin]

Adds a malicious-package OSV report for dependency_confusions@99.9.9.

Source report: https://firewall.lpm.dev/npm/dependency_confusions/v/99.9.9

Evidence summary:

• Published on npm at 2026-07-08T09:44:07.995Z.
• package.json sets index.js as the package main entrypoint and defines postinstall: node index.js.
• During install, index.js builds a JSON payload containing os.userInfo().username, process.env.INIT_CWD || process.cwd(), os.hostname(), first non-internal local IPv4 from os.networkInterfaces(), os.platform(), and an install timestamp.
• index.js sends that payload via https.request to https://webhook.site/264e1903-28ea-48ea-8c55-be58c5a76791.
• LPM Firewall classified the package as malicious/block with low false-positive risk.

Local checks:

• jq parse check passed.
• Lightweight local advisory checks passed.
• The unpkg source references returned 200.
• Could not run make validate locally because Go is not installed on this machine; GitHub Actions should run the official OpenSSF validator.

[elitsa-gosst]

nit, here and below: too many unnecessary references

[tolgaergin]

Updated — I trimmed the extra references and kept only the npm package page plus the LPM report link.