GCVE-110-OSM-2026-2644

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published April 17, 2026

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code. Payload: lib/mapProps.js Secondary files: src/mapProps.ts Key findings: - Environment Variable Exfiltration in lib/mapProps.js: "process.env.DEV_SECRET_VALUE; let retrycnt = 5; while (retrycnt > 0) {..." - Global Variable Shadowing in lib/mapProps.js: "const process = {" - Fetch and Eval/Exec in lib/mapProps.js: "await axios_1.default.get(src, { headers: { [k]: v } ..." - Environment Variable Exfiltration in src/mapProps.ts: "process.env.DEV_SECRET_VALUE; let retrycnt: number = 5; while (retrycn..." - Global Variable Shadowing in src/mapProps.ts: "const process = {" IOCs: - urls: http://keepachangelog.com/, https://www.jsonkeeper.com/b/XB9WY - domains: keepachangelog.com, www.jsonkeeper.com - payloadFileHash: 78e4c19ad8750b69589b717fcc6b1e427c632e6774c26eaecfea05cc54dcc024

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	tsconfig-json-resolver	all (affected)	—

References

Malicious npm package: tsconfig-json-resolver

advisory

vendor

Browse GCVE Records

72,409 records in the GCVE database · Updated July 14, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON