GCVE-110-OSM-2026-5229

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published June 3, 2026

APT malware detected: chai-max. Associated with threat actor(s): DPRK/Lazarus. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. Entrypoint: utils.mjs (install-hook: node utils.mjs) Exfil: https://huggingface.co/api/repos/create (reconstructed, recovery: reconstructed in payload.js) Payload: payload.js Key findings: - Cryptocurrency Wallet Theft in payload.js: "wallet.dat" - Browser Data Theft in payload.js: "Chrome\x20Beta'),_0x2b5f06['default']['join'](_0x4406fb,_0x1bb5d6(0x599),'Applic..." - Download Execute Delete Pattern in payload.js: "spawnSync'])(_0x273f3c(0x54a),[_0x3a4741,_0x5370a8],{'timeout':0x3a98,'env':_0x3..." - Chai-Max Wallet Theft Indicators in payload.js: ".exodus" - Reconstructed Obfuscated URL in payload.js: "https://huggingface.co/api/repos/create" IOCs: - ipv4: 4.0.0.0 - domains: matteocollina.com, Crypto.com, huggingface.co - emails: hello@matteocollina.com - urls: https://huggingface.co/api/repos/create - payloadFileHash: a80e07b242ae78d1541b29c5e734a3cabb6321a99ab9bc58ec25cf5bd2ff3faf

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	logger-active	all (affected)	—

References

Malicious npm package: logger-active

advisory

vendor

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON