VDB
GCVE-110-OSM-2026-1383
GCVE-110-OSM-2026-1383
Advisory PublishedCVSS 9.6/10
Exfiltrates .env file contents, JSON files, OS type, IP address, username, and project working directory path to attacker-controlled domain clob-polymarket.com via three sequential HTTP POST calls at require() time. Uses the validate-trio three-endpoint pattern (/api/validate/system-info, /api/validate/files, /api/validate/project-env) shared across a 7-package cluster in campaign dprk-npm-2026-04.
On require(), dist/logger.js collects OS, IP, username, reads .env and JSON files from process.cwd() recursively, then issues three sequential fetch() POSTs to clob-polymarket.com: (1) system-info; (2) files with envFiles/jsonFiles; (3) project-env with envContent and projectPath=process.cwd().
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | wrapped-logger-utils | 1.0.0 (affected) | — |
Browse GCVE Records
73,393 records in the GCVE database · Updated July 17, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.