GCVE-110-OSM-2026-4033

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published May 11, 2026

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration. [osmalyze-auto] Exfil: https://docs.uipath.com/robot/docs/uipath-assistant (reconstructed, recovery: reconstructed in bundles/uipath-agent.sdk-angular.umd.js) Payload: bundles/uipath-agent.sdk-angular.umd.js Secondary files: fesm2015/uipath-agent.sdk-angular.js, esm2015/angular/src/providers/services/external-operation.service.js Key findings: - Reconstructed Obfuscated URL in bundles/uipath-agent.sdk-angular.umd.js: "https://docs.uipath.com/robot/docs/uipath-assistant" - Reconstructed Obfuscated URL in esm2015/angular/src/providers/services/external-operation.service.js: "https://docs.uipath.com/robot/docs/uipath-assistant" - Reconstructed Obfuscated URL in fesm2015/uipath-agent.sdk-angular.js: "https://docs.uipath.com/robot/docs/uipath-assistant" - Very New NPM Publisher Account IOCs: - urls: https://www.surveymonkey.com/r/5QG3PQF, https://docs.uipath.com/robot, https://date-fns.org/v2.8.1/docs/formatRelative\n, https://date-fns.org/v2.8.1/docs/formatRelative, https://docs.uipath.com/robot/docs/uipath-assistant - domains: www.surveymonkey.com, global.ng, docs.uipath.com, date-fns.org - payloadFileHash: 1d3ab2c3ffb25d0df351b1e29ba832fe621fcd24f7929877e2bed8fbb49fe527

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	@uipath/agent.sdk	0.0.17 (affected)	—

References

Malicious npm package: @uipath/agent.sdk

advisory

vendor

Browse GCVE Records

73,161 records in the GCVE database · Updated July 16, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON