GCVE-110-NPM-2026-034233

Advisory Published

Vulnetix · Advisory published October 4, 2026

[JS-HOOK-DECODE-EGRESS-SEQ] npm lifecycle hook decodes a payload (atob/Buffer.from) AND opens a network egress: the canonical npm install-time exfiltration/staged-execution sequence. A benign hook may decode an asset OR contact a registry, but decode+egress together in an install hook is exfiltration/staging.

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious CodeCWE-200Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Vendor	Product	Versions	Platforms
npm	@vanillagreen/pi-background-tasks	2.1.2 (affected), 2.2.0 (affected)	—

References

advisory

web

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON