VDB
GCVE-110-OSM-2026-5706
GCVE-110-OSM-2026-5706
Advisory PublishedCVSS 9.6/10
Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution.
Entrypoint: index.js (main: index.js)
Payload: loader.js
Key findings:
- Stealth Background Process Spawning in loader.js: "spawn(process.execPath, [tmpFile], {
detached: true,
stdio: "ignore",
c..."
- Download Execute Delete Pattern in loader.js: "writeFileSync(tmpFile, dropperCode, "utf8");
spawn(process.execPath, [tmpFile],..."
- Shell Command Execution in loader.js: "require("child_process")"
- Silent Process Execution in loader.js: "stdio: "ignore""
- Detached Child Process Payload in loader.js: "spawn(process.execPath, [tmpFile], {
detached: true"
IOCs:
- payloadFileHash: a5ead14cb7532cc465ecd9f3330450e8bd6c35fca6b9d9dd2411344828294e83
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | webpack-cache-cycle | 0.1.4 (affected) | — |
Aliases
Browse GCVE Records
72,921 records in the GCVE database · Updated July 15, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.