GCVE-110-OSM-2026-5709

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published June 11, 2026

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. Entrypoint: scripts/inject.js (install-hook: node scripts/inject.js) Payload: index.js Secondary files: scripts/inject.js Key findings: - Shell Command Execution in index.js: "require('child_process')" - Install Hook Executes Local JS File in package.json: ""postinstall": "node scripts/inject.js"" - Shell Command Execution in scripts/inject.js: "require('child_process')" - Very New NPM Publisher Account - Publisher Shows Burner-Account Pattern IOCs: - payloadFileHash: c27277229ee1fce5cc2a578a6045062b12e2bbf672663280c9b0f3acc4fe94d3

Download JSON Open in Console