GCVE-110-OSM-2026-3300

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published April 28, 2026

APT malware detected: chai-max. Associated with threat actor(s): DPRK/Lazarus. Behaviors: obfuscated code. Payload: unimod.obo Key findings: - Chai-Max Cryptocurrency Stealer in unimod.obo: ":1224" - Publisher Has Other Malicious Packages - Whitespace-Padded Hidden Payload in index.js: "} ..." IOCs: - urls: http://www.unimod.org/downloads.html, https://www.patreon.com/MikeTheBiochem, http://www.ncbi.nlm.nih.gov/pubmed/14670044?dopt=AbstractPlus, http://www.ncbi.nlm.nih.gov/pubmed/21432907, http://pubchem.ncbi.nlm.nih.gov/summary/summary.cgi?cid=5369209 (+12 more) - domains: www.unimod.org, c5.patreon.com, www.patreon.com, www.ionsource.com, www.chemsoc.org (+39 more) - payloadFileHash: afc40f7d3ca8b153c272bf42ec76770463e8b018f05d9e64049de63967fc1bd3

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	js-unimode@1.1.7	all (affected)	—

References

Malicious npm package: js-unimode@1.1.7

advisory

vendor

Browse GCVE Records

73,442 records in the GCVE database · Updated July 17, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON