GCVE-110-OSM-2026-13214

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published October 3, 2026

postinstall hook (package.json:7) runs beacon.cjs, which exfiltrates hostname, cwd, and install path to a hardcoded raw-IP endpoint http://185.158.107.175:8787/_ah/dc (beacon.cjs:4, 26-33) over plain HTTP. Combined with the dependency-confusion version 99.0.1 and 'compatibility shim' packaging, this is install-time host reconnaissance to attacker infrastructure. ## Key findings - [high] Install script executes local file — `package/package.json:1` - [high] Dependency-confusion version anomaly — `package/package.json:1` ## Package metadata - Publisher: unknown - Published: 2026-10-03T23:03:33.253Z - Install hooks: none found - SHA-256 (tarball): `n/a (tarball not retained)` ## IOCs (defanged) - 185[.]158[.]107[.]175 - hxxps://185[.]158[.]107[.]175:8787/_ah/dc

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	@kibt/www-nuxt-i18n	all (affected)	—

References

Malicious npm package: @kibt/www-nuxt-i18n

advisory

vendor

Browse GCVE Records

3,142 records in the GCVE database · Updated October 5, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON