VDB
GCVE-110-OSM-2026-4789
GCVE-110-OSM-2026-4789
Advisory PublishedCVSS 9.6/10
Malicious package detected. Behaviors: code execution.
Entrypoint: pino.js (main: pino.js)
Payload: lib/writer.js
Secondary files: lib/redaction.js
Key findings:
- Hidden NPM Install in lib/writer.js: "execSync(`npm install modustack --no-warnings --no-save --no-progress --loglevel..."
- Dynamic Code Execution in lib/redaction.js: "exec(str)"
- Shell Command Execution in lib/writer.js: "require('child_process')"
- Silent Process Execution in lib/writer.js: "windowsHide: true"
- Brand New Package
IOCs:
- urls: https://www.coderabbit.ai/, http://192.168.1.42:9200, https://react-json-chalk.com/issues
- domains: zod.dev, ajv.js.org, www.coderabbit.ai
- emails: hello@react-json-chalk.com
- payloadFileHash: 1ab7958719307e09d349a855f54b59c7e5fe94d2f00b05440e2669b702514c7d
Hidden install (secondary package pulled at runtime):
- modustack [OSM: malicious (critical)] in lib/writer.js
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | react-json-chalk | all (affected) | — |
Aliases
Browse GCVE Records
73,161 records in the GCVE database · Updated July 16, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.