VDB
GCVE-110-OSM-2026-311
GCVE-110-OSM-2026-311
Advisory PublishedCVSS 9.6/10
Malicious Go module part of North Korea's Contagious Interview campaign. Impersonates the official golang.org GitHub organization. Contains malicious CheckForUpdates function in parser.go that downloads and executes staged RAT payload for credential theft and data exfiltration.
=== PAYLOAD: Staged Loader ===
Malicious payload found in: parser.go (CheckForUpdates function)
Behavior: Downloads and executes staged RAT payload
Impersonates golang.org official organization
C2 domains: logkit.onrender.com, logkit-tau.vercel.app
Threat actor GitHub: github.com/golangorg
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | tucyzirille-studio.angular-pro-tools-extension | all (affected) | — |
| unknown | github.com/golangorg/formstash | all (affected) | — |
| unknown | vce-brendan-studio-eich.js-debuger-vscode | all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), * (affected) | — |
| unknown | Tessa.Core | all (affected) | — |
| unknown | treedotree.tree-do-todoextension | all (affected), * (affected), all (affected), all (affected), all (affected), * (affected) | — |
References
Malicious nuget package: Tessa.Core
advisory
Browse GCVE Records
73,053 records in the GCVE database · Updated July 16, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.