GCVE-110-OSM-2026-13211

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published October 4, 2026

package/lib/caller.js:13-24 fetches a base64-hidden URL (iphub-encrypted.vercel.app) and executes the response via new Function.constructor('require', s), giving arbitrary remote code with require access; package/index.js:32-41 silently spawns caller.js as a detached, stdio-ignored child process, a classic hidden second-stage loader. ## Static analysis (vigil) Verdict `BLOCK`, score 42/100. Critical/high findings: - [critical] SC-003 Network exfiltration — `package/lib/caller.js:22` ## Package metadata - Publisher: unknown - Published: 2026-10-04T21:20:42.140Z - Install hooks: none found - SHA-256 (tarball): `f784c3e9b03278a2513203f9e9255bb9cdfda903f93c2e387855996ea97800cd` ## IOCs (defanged) - iphub-encrypted[.]vercel[.]app

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	hardhat-spack	3.0.2 (affected)	—

References

Malicious npm package: hardhat-spack

advisory

vendor

Browse GCVE Records

3,111 records in the GCVE database · Updated October 6, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON