GCVE-110-OSM-2026-1604

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published April 9, 2026

Malicious package detected. Behaviors: data exfiltration. Payload: src/larkbot/index.js Key findings: - Environment Variable Exfiltration in src/larkbot/index.js: "process.env.RABBY_LARK_CHAT_URL; const secret = process.env.RABBY_LARK_CHAT_SECR..." - Clipboard Access in src/cli.js: "navigator.clipboard.writeText" IOCs: - domains: popup.click, btn.click, 78.eU, b.click, el.click (+6 more) - payloadFileHash: db753e53292bc48d42749fe0a2284bbd63a50a4fc901e354c3419967b3a43f52

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	chrome-extension-automator	* (affected)	—

References

Malicious npm package: chrome-extension-automator

advisory

vendor

Browse GCVE Records

72,148 records in the GCVE database · Updated July 14, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON