VDB
GCVE-110-OSM-2026-1320
GCVE-110-OSM-2026-1320
Advisory PublishedCVSS 9.6/10
Part of the UNC1069 attack that compromised the axios package. North Korean threat actors looking to build another supply chain attack.
Package pulls a malicious Windows or Linux payload from https://gist.githubusercontent.com/admondtamang/814132e794e5d007e9b8ebd223a9494f/raw/1c5d51c2002f452a4dd58a1a73a9dd90a7fe0297/
Payload: bin/setup.cjs
Key findings:
- Download Execute Delete Pattern in bin/setup.cjs: "writeFileSync(vbsPath, vbScript);
execCommand = `cscript "${vbsPath}..."
- Shell Command Execution in bin/generate.js: "spawnSync("
- Shell Command Execution in bin/setup.cjs: "require("child_process")"
IOCs:
- urls: https://admondtamang.com.np/
- domains: admondtamang.com, packages.npm.org, email.com, admondtamang.com.np
- payload URL: https://gist.githubusercontent.com/admondtamang/814132e794e5d007e9b8ebd223a9494f/raw/1c5d51c2002f452a4dd58a1a73a9dd90a7fe0297/linux.payload
- payloadFileHash: ff7adbc7e1984eb326e58944a44fb35a023ccaf1e31309c27cea65ad866a7751
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | mgc | — | — |
Browse GCVE Records
72,409 records in the GCVE database · Updated July 14, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.