VDB
GCVE-110-OSM-2026-10468
GCVE-110-OSM-2026-10468
Advisory PublishedCVSS 5.4/10
This package is a self-described security research PoC to see if the @mexc namespace can be claimed.
ENTRY
postinstall.js (install-hook: node postinstall.js)
- Install Hook Executes Local JS File in package.json
EXFIL
- System Information Collection in postinstall.js: "os.userInfo()"
ADDITIONAL FINDINGS
- Publisher Shows Burner-Account Pattern
- Rapid Version Publishing
PAYLOAD FILES
postinstall.js
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
5.4/10
Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | @mexc/shared-utils | all (affected) | — |
Aliases
Browse GCVE Records
474 records in the GCVE database · Updated August 27, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.