VDB
GCVE-110-OSM-2026-5716
GCVE-110-OSM-2026-5716
Advisory PublishedCVSS 9.6/10
Malicious package detected. Behaviors: code execution, obfuscated code.
Entrypoint: launcher.js (bin: launcher.js)
Payload: launcher.js
Secondary files: server.obf.js
Key findings:
- Stealth Background Process Spawning in launcher.js: "spawn(process.execPath, [__filename], {
cwd: APP_DIR,
detached: true..."
- Shell Command Execution in launcher.js: "require('child_process')"
- Silent Process Execution in launcher.js: "stdio: 'ignore'"
- Detached Child Process Payload in launcher.js: "spawn(process.execPath, [__filename], {
cwd: APP_DIR,
detached: true"
- Startup Persistence in public/css/style.css: ".profile"
IOCs:
- urls: http://192.168.1.16:3000
- payloadFileHash: b236ea6f5c2a9689c846ef6bbf4dcfcc168873b71b4a2638677ad68fa9a4edab
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | sensivity | all (affected) | — |
Aliases
Browse GCVE Records
73,866 records in the GCVE database · Updated July 19, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.