VDB
GCVE-110-OSM-2026-5206
GCVE-110-OSM-2026-5206
Advisory PublishedCVSS 8.8/10
Malicious package detected. Behaviors: data exfiltration, obfuscated code.
Entrypoint: dist/index.js (bin: dist/index.js)
Exfil: https://api.hyperliquid.xyz (custom-c2, recovery: plaintext in dist/index.js)
Payload: dist/index.js
Secondary files: dist/mcp.js
Key findings:
- Suspicious TLD Domain in dist/index.js: "https://api.hyperliquid.xyz"
- Suspicious TLD Domain in dist/mcp.js: "https://api.hyperliquid.xyz"
IOCs:
- urls: https://hyperliquid.xyz, https://openclaw.dev, https://api.hyperliquid.xyz, https://api.hyperliquid-testnet.xyz, https://api.hyperliquid.xyz\ (+1 more)
- domains: hyperliquid.xyz, openclaw.dev, api.hyperliquid.xyz
- ethereumAddresses: 0x0000000000000000000000000000000000000000, 0x49f9293df6c85a86dacc2677032a92d86c7bc828
- payloadFileHash: 2bfee4b4b6a6e0d64b983c5ae052776f2ade86d7febbf8000a84adf5b058da6b
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
8.8/10
High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | @2oolkit/hyperliquid-cli | 0.2.6 (affected) | — |
Aliases
Browse GCVE Records
72,409 records in the GCVE database · Updated July 14, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.