VDB
GCVE-110-OSM-2026-3405
GCVE-110-OSM-2026-3405
Advisory PublishedCVSS 9.6/10
Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution.
Payload: bin/mbt
Key findings:
- Environment Variable Exfiltration in bin/mbt: "process.env.BINWRAP_PLATFORM || process.platform;
var arch = process.env.BINWRAP..."
- Shell Command Execution in bin/mbt: "child_process").spawn"
IOCs:
- urls: http://www.apache.org/licenses/, http://www.apache.org/licenses/LICENSE-2.0, https://goreportcard.com/badge/github.com/SAP/cloud-mta-build-tool, https://goreportcard.com/report/github.com/SAP/cloud-mta-build-tool, https://bestpractices.coreinfrastructure.org/projects/3400/badge (+8 more)
- domains: www.apache.org, goreportcard.com, bestpractices.coreinfrastructure.org, api.dependabot.com, dependabot.com (+3 more)
- payloadFileHash: c80b1778fc93ec09307a8e3008477bbe43ad70c0824300efbb1f1c654f03f0a0
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | mbt | 1.2.49 (affected) | — |
| unknown | react-native-parallax-scroll-view-updated | all (affected), all (affected) | — |
References
Malicious npm package: mbt
advisory
Browse GCVE Records
72,096 records in the GCVE database · Updated July 14, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.