GCVE-110-OSM-2026-5187

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published June 1, 2026

Malicious package detected. Entrypoint: src/index.ts (main: ./src/index.ts) Payload: src/webhook.ts Key findings: - Publisher Has Other Malicious Packages - Rapid Version Publishing IOCs: - urls: https://your-host/annotations/webhook, https://linear.app, https://stripe.com, https://worker.example/api/sessions/sid/annotations/webhook - domains: stripe.com, agentation.com - webhookServices: https://webhook.site/your-id - payloadFileHash: 1630eb42932ed3409efdfcf5b519275d573f00a953749c0bd1ada78d9ad08fbd

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	@coframe-gtm/annotations	1.0.4 (affected)	—

References

Malicious npm package: @coframe-gtm/annotations

advisory

vendor

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON