VDB
GCVE-110-OSM-2026-4954
GCVE-110-OSM-2026-4954
Advisory PublishedCVSS 9.6/10
Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code.
Entrypoint: lib/main.js (main: lib/main.js)
Exfil: https://www.jsonkeeper.com/b/VKUNI (custom-c2, recovery: decoded in lib/main.js)
Payload: lib/main.js
Key findings:
- Decoded Base64 Content in lib/main.js
- Dynamic Code Execution in lib/main.js: "exec(lines)"
- Dynamic Base64 Decoding in lib/main.js: "Buffer.from(encrypted, 'base64')"
IOCs:
- urls: https://tuple.app/dotenv, https://dotenvx.com, https://dotenvx.com/precommit, https://dotenvx.com/prebuild, https://techcrunch.com/2023/01/05/circleci-breach/ (+10 more)
- domains: skills.sh, dotenvx.com, graphite.dev, techcrunch.com, 12factor.net (+7 more)
- emails: security@dotenvx.com, key_1234@dotenvx.com, key_7890@dotenvx.com
- payloadFileHash: 5cc30e2db46bb70e043b5f7fdb2d526caa2a4fcf83806c1c08bd6f0a1559ef43
Decoded/deobfuscated IOCs:
- urls: https://www.jsonkeeper.com/b/VKUNI
- domains: www.jsonkeeper.com
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | web-dotenv | all (affected) | — |
Aliases
Browse GCVE Records
72,409 records in the GCVE database · Updated July 14, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.