GCVE-110-OSM-2026-13231

Advisory PublishedCVSS 5.4/10

Vulnetix · Advisory published October 4, 2026

src/package/postinstall.js runs on postinstall (package.json), exfiltrates hostname/username/cwd/network interfaces to hardcoded C2 'telemetry-edge.net' with TLS verification disabled (lines 5, 15, 28), and executes arbitrary commands returned by the server via execSync(cmd.exec) (lines 35-37). This is host-data exfiltration plus remote code execution from an install hook. ## Static analysis (vigil) Verdict `REVIEW`, score 16/100. Critical/high findings: - [high] MANIFEST-007 Install script executes local file — `package/package.json:1` ## Package metadata - Publisher: unknown - Published: 2026-10-04T13:36:14.716Z - Install hooks: postinstall=node postinstall.js - SHA-256 (tarball): `fc1972309d0f420e870c738f0191889648532445f5954ca7e517dc586b2ba388` ## IOCs (defanged) - telemetry-edge[.]net

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

5.4/10

Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Affected Products

Vendor	Product	Versions	Platforms
unknown	botmaker-cli	0.1.19 (affected)	—

References

Malicious npm package: botmaker-cli

advisory

vendor

Browse GCVE Records

3,142 records in the GCVE database · Updated October 5, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON