VDB
GCVE-110-OSM-2026-10498
GCVE-110-OSM-2026-10498
Advisory PublishedCVSS 9.6/10
Malicious package detected. Behaviors: data exfiltration, obfuscated code.
DESTINATION
- custom-c2: https://canarytokens.com/articles/tags/images/j11lq4swuzvslc96qfi9pmsji/submit.aspx (primary, decoded) in original.js
- reconstructed: https://canarytokens.com/articles/tags/images/j11lq4swuzvslc96qfi9pmsji/submit.aspx?type=no_user_span (reconstructed) in i.js
- reconstructed: https://canarytokens.com/articles/tags/images/j11lq4swuzvslc96qfi9pmsji/submit.aspx?type=started (reconstructed) in i.js
- custom-c2: canarytokens.com (decoded) in original.js
- custom-c2: noviembrenacional.com (decoded) in original.js
- custom-c2: proton.me (decoded) in original.js
- emails: nyxalor_25@proton.me (c2, plaintext)
EXFIL
- Data Encoding for Exfiltration in i.js: "btoa("
- Data Encoding for Exfiltration in original.js: "btoa("
OBFUSCATION
- Decoded Unicode Escape Content in i.js (x59)
- Unicode Escape Obfuscation in i.js: "\u0068\u0074\u0074\u0070\u0073\u003A\u002F\u002F\u0063\u0061\u006E\u0061\u0072\u..."
- Deobfuscation Failed in i.js
- Obfuscation patterns: hexVariables, unicodeHeavy in i.js
- recovered 3 urls, 4 domains, 1 emails from decoded/deobfuscated content
ADDITIONAL FINDINGS
- Reconstructed Obfuscated URL in i.js: "https://canarytokens.com/articles/tags/images/j11lq4swuzvslc96qfi9pmsji/submit.a..."
PAYLOAD FILES
i.js
INDICATORS (IOCs)
- payloadFileHash: d12fe0144ad08f27bfa5a43fc821fbb6ca66ad19a6520b6f66b4d33d634bd5db
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | adxaa | all (affected) | — |
Browse GCVE Records
69,369 records in the GCVE database · Updated August 25, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.