GCVE-110-OSM-2026-13220

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published October 4, 2026

lib/config.js is an obfuscator.io-obfuscated payload injected into a repackaged pino logger, containing execSync shell execution (SC-015), hidden detached child_process spawns with windowsHide/stdio-ignore (GD-006), dynamic Function-constructor eval (OBF-008), and obfuscated requires of fs/path/child_process — none of which any logger needs. An unexplained axios dependency (package.json:26) further supports remote download/exfiltration behavior. ## Static analysis (vigil) Verdict `BLOCK`, score 55/100. Critical/high findings: - [critical] SC-015 Shell command execution — `package/lib/config.js:1` - [critical] SC-015 Shell command execution — `package/lib/config.js:1` - [high] OBF-028 Obfuscator.io string-array rotation — `package/lib/config.js:1` ## Package metadata - Publisher: unknown - Published: 2026-10-04T18:16:21.160Z - Install hooks: none found - SHA-256 (tarball): `5939b15fae5fd976387431b2c6d67ba2e1ee533c05529d33c65c320fbd0ce0a7` ## IOCs (defanged) - hk[.]me - hm[.]me - obfuscator[.]io - py[.]io - zg[.]me

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	hardhat-kex	all (affected)	—

References

Malicious npm package: hardhat-kex

advisory

vendor

Browse GCVE Records

3,142 records in the GCVE database · Updated October 5, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON