GCVE-110-OSM-2026-2507

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published April 16, 2026

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. Payload: src/connect/mapProps.ts Key findings: - Detached Child Process Payload in dist/index.js: "spawn("node", [script, JSON.stringify(firstArg)], { detached: true" - Detached Child Process Payload in src/components/Props.ts: "spawn("node", [script, JSON.stringify(firstArg)], { detached: true" - Environment Variable Exfiltration in src/connect/mapProps.ts: "process.env.DEV_SECRET_VALUE; let retrycnt: number = 5; while (retrycn..." - Global Variable Shadowing in src/connect/mapProps.ts: "const process = {" - Shell Command Execution in dist/index.cjs: "require("child_process")" IOCs: - urls: http://www.reactiflux.com, https://redux.js.org/introduction/installation, https://redux.js.org/recipes/configuring-your-store/, https://webpack.js.org/, http://browserify.org/ (+5 more) - domains: www.reactiflux.com, redux.js.org, webpack.js.org, browserify.org, cdnjs.com (+7 more) - emails: discord-redux@reactiflux-61DAFB.svg, dan.abramov@me.com - payloadFileHash: 14556ad9df3cb9b60899347fea9ae17b7d565e90c360e193d557b2bdd10f2817

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	react-saga-redux	all (affected)	—

References

Malicious npm package: react-saga-redux

advisory

vendor

Browse GCVE Records

73,442 records in the GCVE database · Updated July 17, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON