GCVE-110-OSM-2026-13230

Advisory PublishedCVSS 5.4/10

Vulnetix · Advisory published October 4, 2026

postinstall hook executes remote second-stage code at install time: runtime-install.js:609 does `curl ... | sh` and lines 597-603 run remote PowerShell via `irm` with `-ExecutionPolicy Bypass`, from a GitHub raw URL outside any verified registry artifact. It also strips macOS quarantine on downloaded binaries (runtime-install.js:545), enabling unsigned code execution; the 'digest-verified' claims appear only in comments, not in the executed code path. ## Static analysis (vigil) Verdict `REVIEW`, score 22/100. Critical/high findings: - [high] MANIFEST-007 Install script executes local file — `package/package.json:1` ## Package metadata - Publisher: unknown - Published: 2026-10-04T15:31:18.358Z - Install hooks: postinstall=node bin/postinstall.js - SHA-256 (tarball): `87300130f9946c35014f5e6cd93f412cb69491bd81ede93d51c122d7d55f9dba`

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

5.4/10

Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions	Platforms
unknown	@firedmosquito831/my-claude-code	7.72.2 (affected)	—

References

Malicious npm package: @firedmosquito831/my-claude-code

advisory

vendor

Browse GCVE Records

3,142 records in the GCVE database · Updated October 5, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON