VDB

GCVE-110-OSM-2026-342

GCVE-110-OSM-2026-342
Advisory PublishedCVSS 9.6/10
Vulnetix · Advisory published April 17, 2026
Malicious package detected. Payload: extconf.rb Key findings: - Decoded Base64 Content in extconf.rb - Decoded Base64 Content in extconf.rb IOCs: - domains: baoreqygjveumkkxydcd.supabase.co - payloadFileHash: e745147b193a958bf7d6889ccb82795e6d54c6b921baac64f3c691a045d46424 Decoded/deobfuscated IOCs: - domains: baoreqygjveumkkxydcd.supabase.co
Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersionsPlatforms
unknownmswincx.antigravity-cockpit-extensionall (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected)—
unknownlyu-wen-studio-web-han.better-formatter-vscodeall (affected), * (affected), all (affected), all (affected), all (affected), all (affected)—
unknowndegica_datadog9.1.4 (affected)—
unknownmarkvalid.vscode-mdvalidator-extensionall (affected)—
unknownTheOpenAI.APIall (affected)—

References

vendor
Malicious vscode package: mswincx.antigravity-cockpit-extension
advisory
vendor
Malicious vscode package: lyu-wen-studio-web-han.better-formatter-vscode
advisory
Malicious vscode package: markvalid.vscode-mdvalidator-extension
advisory
vendor
Malicious nuget package: TheOpenAI.API
advisory
vendor
Malicious rubygems package: degica_datadog
advisory
vendor

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON
$ Console Community · 100/wk Open console ›