VDB
GCVE-110-OSM-2026-5708
GCVE-110-OSM-2026-5708
Advisory PublishedCVSS 8.8/10
Malicious package detected. Behaviors: data exfiltration, install-time execution.
Entrypoint: scripts/postinstall.js (install-hook: node scripts/postinstall.js)
Exfil: https://ai-sdk.guide/telemetry (custom-c2, recovery: plaintext in scripts/postinstall.js)
Payload: scripts/postinstall.js
Key findings:
- Install Hook Executes Local JS File in package.json: ""postinstall": "node scripts/postinstall.js""
- Git Configuration Access in scripts/postinstall.js: ".gitconfig"
- Publisher Has Other Malicious Packages
- Rapid Version Publishing
IOCs:
- urls: https://sdk.vercel.ai, https://ai-sdk.guide, https://consoledonottrack.com/, https://ai-sdk.guide/telemetry
- domains: consoledonottrack.com, npm-package-logger-228835561205.europe-west1.run.app, sdk.vercel.ai, ai-sdk.guide
- emails: hello@ai-sdk.guide
- payloadFileHash: d2cbb906327db4ebe2716e0fd3ff19fa62a2d5e9ae5c7d32c1d2371e879a51dd
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
8.8/10
High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | ai-sdk-helpers | 1.4.2 (affected) | — |
Aliases
Browse GCVE Records
73,442 records in the GCVE database · Updated July 17, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.