VDB
GCVE-110-OSM-2026-1417
GCVE-110-OSM-2026-1417
Advisory PublishedCVSS 9.6/10
Suspected dependency confusion attack. Behaviors: code execution, install-time execution.
Payload: postinstall.js
Key findings:
- Download Execute Delete Pattern in postinstall.js: "execution
setTimeout(() => {
try { fs.unlink"
- Decoded Base64 Content in postinstall.js
- Shell Command Execution in postinstall.js: "require('child_process')"
- Silent Process Execution in postinstall.js: "stdio: 'ignore'"
- POST Method Defined for Exfiltration in postinstall.js: "method: 'POST',
timeout: 2000
}, () => {});
req.on('error', () => {});
req.wri..."
IOCs:
- ipv4: 192.0.2.1
- domains: hook.sh
- awsAccessKeys: AKIAIOSFODNN7EXAMPLE
- urls: http://192.0.2.1/8000/exfil
- ips: 192.0.2.1
- payloadFileHash: 22f347af112199149c1a37663b658518e4c13ebda3239f0db0c0b50da2316613
Decoded/deobfuscated IOCs:
- urls: http://192.0.2.1/8000/exfil
- ips: 192.0.2.1
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | @hermit46/depguard-test-malicious | all (affected) | — |
Browse GCVE Records
73,685 records in the GCVE database · Updated July 18, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.