VDB
GCVE-110-OSM-2026-211
GCVE-110-OSM-2026-211
Advisory PublishedCVSS 9.6/10
Malicious NuGet package wrapping legitimate Chinese library functionality around an infostealer payload. Executes via module initializer JIT hook, harvesting browser/wallet/SSH credentials and exfiltrating to dns-providersa2[.]com.
Malicious payload found in: module initializer (JIT hook into CLR)
Obfuscation: .NET Reactor Necrobit + RSA-1024 Anti-Tamper
C2 beacon: https://dns-providersa2[.]com/check
C2 exfil: https://dns-providersa2[.]com/upload
Staging file: C:\ProgramData\Microsoft OneDrive\keys.dat
SHA256: 019e6c2cf58386039133981f3377b085fbd70c98ae8613c7c6a4f10a9f2d9824
Behavior: 12-browser Chromium + Firefox credential theft; 5 wallet extensions and 8 desktop wallets targeted; SSH keys, Outlook, Steam, documents stolen; process injection for persistence.
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | OCI.DotNetSDK.Servicemanager.proxy | all (affected) | — |
| unknown | OCI.DotNetSDK.Osubusage.Net | * (affected), all (affected), all (affected), all (affected), * (affected), * (affected) | — |
| unknown | IR.iplus32 | all (affected) | — |
| unknown | fastapi-middleware-cors | * (affected) | — |
| unknown | OCI.DotNetSDK.Visualbuilder.Net | * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), * (affected) | — |
Aliases
References
Malicious nuget package: IR.iplus32
advisory
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.