VDB
GCVE-110-NPM-2026-033325
GCVE-110-NPM-2026-033325
Advisory Published
The npm package `@inferencesh/belt` (version 1.25.11) was flagged as malicious by automated package analysis (2 corroborating detection(s)). Installing it may execute attacker-controlled code via lifecycle scripts or bundled JavaScript. Verdict path: evidence — for ownership-only paths (owner-known-bad / multi-identity) the change of ownership is a compounding indicator the engine correlated with other signals, not standalone proof. This verdict is produced by static analysis and is subject to human review.
Weaknesses (CWE)
CWE-506Embedded Malicious CodeCWE-200Exposure of Sensitive Information to an Unauthorized Actor
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| npm | @inferencesh/belt | 1.16.13 (affected), 1.19.6 (affected), 1.19.7 (affected), 1.19.8 (affected), 1.19.9 (affected), 1.19.10 (affected), 1.19.11 (affected), 1.19.12 (affected), 1.19.13 (affected), 1.19.14 (affected), 1.19.17 (affected), 1.19.20 (affected), 1.19.21 (affected), 1.19.22 (affected), 1.19.24 (affected), 1.20.0 (affected), 1.21.0 (affected), 1.22.0 (affected), 1.22.1 (affected), 1.24.1 (affected), 1.24.2 (affected), 1.24.6 (affected), 1.25.0 (affected), 1.25.4 (affected), 1.25.6 (affected), 1.25.9 (affected), 1.25.10 (affected), 1.25.11 (affected) | — |
Browse GCVE Records
20,323 records in the GCVE database · Updated October 20, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.