VDB
GCVE-110-OSM-2026-5267
GCVE-110-OSM-2026-5267
Advisory PublishedCVSS 9.6/10
GitHub repository compromised as part of the IronWorm self-propagating worm (JFrog Security Research, Jun 2026). Attacker pushed backdated, bot-spoofed commits that inject a credential-stealing payload and propagate the worm across the maintainer's other projects.
Repository compromised in the IronWorm campaign. Malicious commits injected via .github/scripts/precheck and GitHub Actions workflow hijacking, exfiltrating secrets with ${{ toJSON(secrets) }}. Commits backdated and spoofed as claude@users.noreply.github.com and bot identities (dependabot[bot]/renovate[bot]/github-actions[bot]). Drops UPX-packed ELF (package/tools/setup) and eBPF rootkit; harvests cloud/AI credentials and Exodus wallet seed phrases; exfiltrates over Tor C2 with temp.sh fallback. Operator ETH wallet: 0x7e28D9889f414B06c19a22A9Bd316f0AC279a4d6.
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | all (affected) | — |
References
Malicious package:
advisory
Browse GCVE Records
73,053 records in the GCVE database · Updated July 16, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.