VDB
GCVE-110-OSM-2026-320
GCVE-110-OSM-2026-320
Advisory PublishedCVSS 9.6/10
Malicious PHP/Packagist package part of North Korea's Contagious Interview campaign. Impersonates the golang.org brand in the PHP ecosystem. Contains malicious code in func/log.php that downloads and executes staged RAT payload for credential theft and data exfiltration.
=== PAYLOAD: Staged Loader ===
Malicious payload found in: func/log.php
Behavior: Downloads and executes staged RAT payload
Impersonates golang.org in PHP ecosystem
C2 domains: logkit.onrender.com, logkit-tau.vercel.app
Threat actor GitHub: github.com/golangorg
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | golangorg/logkit | all (affected) | — |
| unknown | tamokill12.foundry-pdf-extension | all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), * (affected) | — |
| unknown | studio-velte-distributor.pro-svelte-extension | all (affected) | — |
| unknown | Stl.Fusion.Ext.Contracts.Net | * (affected) | — |
| unknown | studio-jjalaire-team.professional-quarto-extension | all (affected), all (affected), all (affected), all (affected), all (affected), * (affected) | — |
References
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.