VDB
GCVE-110-OSM-2026-568
GCVE-110-OSM-2026-568
Advisory PublishedCVSS 5.4/10
Malicious VSCode tasks.json that delivers malware to user device, when the repository is opened in vscode.
The tasks.json file uses URL shortners to hide attacker controlled C2. The method was reported by OSM in TasksJacker campaign. Note that at the time of this report, the attacker's URL shortner organisation has been suspended by the hosting provider.
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
5.4/10
Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | all (affected) | — | |
| unknown | simple-util-kit | all (affected), * (affected), all (affected), all (affected) | — |
| unknown | flutcode.flutter-extension | all (affected) | — |
| unknown | omaronsec | all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), * (affected) | — |
| unknown | tailwind-compile | all (affected), all (affected) | — |
References
Malicious npm package: omaronsec
advisory
Browse GCVE Records
73,442 records in the GCVE database · Updated July 17, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.