VDB
GCVE-110-OSM-2026-3404
GCVE-110-OSM-2026-3404
Advisory PublishedCVSS 9.6/10
Malicious package detected. Behaviors: code execution.
Payload: lib/SQLiteService.js
Secondary files: lib/sql.js.js
Key findings:
- Dynamic Code Execution in lib/SQLiteService.js: "exec(sql)"
- Dynamic Code Execution in lib/sql.js.js: "exec(sql)"
IOCs:
- urls: http://keepachangelog.com/, http://www.apache.org/licenses/, http://www.apache.org/licenses/LICENSE-2.0, https://cap.cloud.sap, https://cap.cloud.sap/docs/guides/databases/sqlite (+2 more)
- domains: keepachangelog.com, www.apache.org, www.sap.com, cap.cloud.sap, api.reuse.software
- payloadFileHash: 61b6d33f66089f173ab4b2dbd2a3aed3e7cbb8021f536a827aaf6abb07a0fa73
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | chai-bundle | all (affected), all (affected) | — |
| unknown | @cap-js/sqlite | 2.4.0 (affected) | — |
References
Malicious npm package: chai-bundle
advisory
Browse GCVE Records
73,834 records in the GCVE database · Updated July 19, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.