VDB

GCVE-110-OSM-2026-11492

GCVE-110-OSM-2026-11492
Advisory PublishedCVSS 5.4/10
Vulnetix · Advisory published September 1, 2026
Malicious package detected. Payload: index.js Key findings: - OAST/Interactsh Exfiltration in index.js: ".oast.pro" IOCs: - urls: https://your-internal-registry.com/ - domains: your-internal-registry.com, d551v5tcd7515a4e2d6gk68b6cyiu3jrb.oast.pro - payloadFileHash: 769ab6477e7882635f2cb64f1ddfeb2900317eac2ccf45b4d0afbc214844d037
Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1
5.4/10
Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected Products

VendorProductVersionsPlatforms
unknownkid-apiall (affected)—

Aliases

MAL-2026-20

References

Malicious npm package: kid-api
advisory
advisory
vendor

Browse GCVE Records

3,521 records in the GCVE database · Updated September 6, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON
$ Console Community · 100/wk Open console ›