VDB
GCVE-110-OSM-2026-3730
GCVE-110-OSM-2026-3730
Advisory PublishedCVSS 9.6/10
[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution.
[osmalyze-auto] Entrypoint: index.js (main: index.js)
Payload: lib/const.js
Secondary files: index.js
Key findings:
- Stealth Background Process Spawning in index.js: "spawn(process.execPath, [script], {
detached: true,
stdio: 'ignore'
}"
- Decoded Base64 Content in lib/const.js
- Shell Command Execution in index.js: "require('child_process')"
- Silent Process Execution in index.js: "stdio: 'ignore'"
- Detached Child Process Payload in index.js: "spawn(process.execPath, [script], {
detached: true"
IOCs:
- urls: https://jsonkeeper.com/b/4NAKK
- domains: jsonkeeper.com
- payloadFileHash: d10853dde92fdc48d8cb5505d89e0030fd35e1416a16a820fe5ec4aceef01c4f
Decoded/deobfuscated IOCs:
- urls: https://jsonkeeper.com/b/4NAKK
- domains: jsonkeeper.com
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | chai-guard | all (affected) | — |
Browse GCVE Records
74,557 records in the GCVE database · Updated July 23, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.