GCVE-110-OSM-2026-4790

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published May 26, 2026

APT malware detected: chai-max. Associated with threat actor(s): DPRK/Lazarus. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. Entrypoint: utils.js (install-hook: node utils.js) Payload: payload.js Key findings: - Cryptocurrency Wallet Theft in payload.js: "wallet.dat" - Browser Data Theft in payload.js: "Chrome\x20Beta','stringify','shape','platform','fin','Invalid','serverMaxWindowB..." - Download Execute Delete Pattern in payload.js: "writeFileSync'](_0x4289e7,_0x21c945);const _0x3ad1a5=(0x0,_0x3b1287['spawn'])('s..." - Chai-Max Wallet Theft Indicators in payload.js: ".exodus" - Stealth Background Process Spawning in utils.js: "spawn(process.execPath, [script, "--bg"], { detached: true, stdio:..." IOCs: - ipv4: 4.0.0.0 - domains: matteocollina.com, Crypto.com - emails: hello@matteocollina.com - payloadFileHash: f447b007e2d8a315a2fff6c51406334584ab0f3fa66bb3c210df1e9eb1fc6823

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	msc-terminal	all (affected)	—

References

Malicious npm package: msc-terminal

advisory

vendor

Browse GCVE Records

73,738 records in the GCVE database · Updated July 19, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON