VDB

GCVE-110-OSM-2026-5616

GCVE-110-OSM-2026-5616
Advisory PublishedCVSS 9.6/10
Vulnetix · Advisory published June 10, 2026
APT malware detected: chai-max. Associated with threat actor(s): DPRK/Lazarus. Behaviors: data exfiltration, install-time execution. Entrypoint: src/canary.js (install-hook: node src/canary.js) Exfil: https://96e03fa6c292469a-172-245-86-254.serveousercontent.com (reconstructed, recovery: reconstructed in src/canary.js) Payload: src/canary.js Secondary files: src/index.js Key findings: - Reconstructed Obfuscated URL in src/canary.js: "https://96e03fa6c292469a-172-245-86-254.serveousercontent.com" - Chai-Max Wallet Theft Indicators in src/index.js: ".exodus" - Install Hook Executes Local JS File in package.json: ""postinstall": "node src/canary.js"" - Brand New Package IOCs: - domains: hackerone.com, 96e03fa6c292469a-172-245-86-254.serveousercontent.com, docs.exodus.com - urls: https://96e03fa6c292469a-172-245-86-254.serveousercontent.com - payloadFileHash: 16502b9065d4976ebb34fd49d0fb75f3cd0e64cf8d35872b419a6b6752485d51
Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersionsPlatforms
unknowngrateful-checkoutall (affected)—

Aliases

MAL-2026-5444

References

Malicious npm package: grateful-checkout
advisory
advisory
vendor

Browse GCVE Records

74,557 records in the GCVE database · Updated July 23, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON
$ Console Community · 100/wk Open console ›