GCVE-110-OSM-2026-1215

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published April 1, 2026

Byte-for-byte identical payload to strapi-plugin-content-sync (SHA256: 15e3da4b...). Published as a separate package to increase attack surface — a developer who installs strapi-plugin-debug-tools (plausible name for a debugging aid) receives exactly the same PostgreSQL credential dump, core_store JWT secret theft, wallet table exfiltration, and Docker socket enumeration as strapi-plugin-content-sync. All data exfiltrated to 144.31.107.231:9999. postinstall.js (174 lines, SHA256: 15e3da4b282eb9b4c0fc000aa9ee8468aeefff643a776fc5bbb2dd3522a8daa5): identical to strapi-plugin-content-sync. See strapi-plugin-content-sync for full payload description. The identical hash confirms this is a deliberate copy published under a different name to maximize installation probability — 'debug-tools' is a plausible package name for developers.

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	strapi-plugin-debug-tools	3.6.8 (affected)	—

References

Malicious npm package: strapi-plugin-debug-tools

advisory

vendor

Browse GCVE Records

73,738 records in the GCVE database · Updated July 19, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON