GCVE-110-OSM-2026-379

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published March 26, 2026

This package impersonates a well-known Go module and replicates the existing functionality, but exfiltrates data to a third-party that the attacker controls. These packages impersonate Google's legitimate github.com/google/uuid and Paul Borman's github.com/pborman/uuid libraries. They preserve legitimate UUID functionality while embedding a backdoor through a hidden Valid function that silently encrypts and exfiltrates caller-supplied data.

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	EladNahman.Super-Cool-Extension	all (affected)	—
unknown	github.com/bpoorman/uuid	all (affected)	—
unknown	carrycodeai.carrycode-vscode	all (affected), all (affected), all (affected), all (affected), all (affected), all (affected)	—
unknown	yujiitadori.demon-slayer-infinity-castle	all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected)	—