VDB

GCVE-110-OSM-2026-5614

GCVE-110-OSM-2026-5614
Advisory PublishedCVSS 9.6/10
Vulnetix · Advisory published June 10, 2026
Malicious package detected. Behaviors: install-time execution. Entrypoint: src/canary.js (install-hook: node src/canary.js) Exfil: https://96e03fa6c292469a-172-245-86-254.serveousercontent.com/c (reconstructed, recovery: reconstructed in src/canary.js) Payload: src/canary.js Key findings: - Reconstructed Obfuscated URL in src/canary.js: "https://96e03fa6c292469a-172-245-86-254.serveousercontent.com/c" - Install Hook Executes Local JS File in package.json: ""postinstall": "node src/canary.js"" - Brand New Package IOCs: - domains: 96e03fa6c292469a-172-245-86-254.serveousercontent.com - urls: https://96e03fa6c292469a-172-245-86-254.serveousercontent.com/c - payloadFileHash: ef2b6f485b2532da51b9f5f82a44416947f1d965023718a03005da3a51a68b45
Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersionsPlatforms
unknowngrateful-paymentsall (affected)—

Aliases

MAL-2026-5445

References

Malicious npm package: grateful-payments
advisory
advisory
vendor

Browse GCVE Records

73,834 records in the GCVE database · Updated July 19, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON
$ Console Community · 100/wk Open console ›