GCVE-110-OSM-2026-1411

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published April 3, 2026

Exfiltrates environment variables, .env file contents, and project metadata to attacker-controlled domain logger.clob.health via HTTP POST calls at require() time. Uses J2TEAM-obfuscated dist/logger.js; confirmed endpoints include /api/validate/system-info and /api/validate/tdata/upload; additional paths obfuscated via string rotation. On require(), dist/logger.js (J2TEAM obfuscated, webcrack-resistant) collects OS info, IP address, username, .env contents, and JSON files from process.cwd(), then POSTs to https://logger.clob.health. Confirmed literal endpoints: /api/validate/system-info and /api/validate/tdata/upload. Three additional fetch() calls reference obfuscated string lookup indices for their paths. envFiles, jsonFiles, envContent, and projectPath are confirmed field names in the rotation array.

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	pretty-fancy	1.0.4 (affected)	—

References

Malicious npm package: pretty-fancy

advisory

vendor

Browse GCVE Records

73,734 records in the GCVE database · Updated July 18, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON