VDB
GCVE-110-OSM-2026-5781
GCVE-110-OSM-2026-5781
Advisory PublishedCVSS 8.8/10
Malicious package detected. Behaviors: data exfiltration, code execution.
Entrypoint: bin/goreleaser.js (bin: ./bin/goreleaser.js)
Exfil: https://goreleaser.com/static/latest (custom-c2, recovery: plaintext in bin/goreleaser.js)
Payload: bin/goreleaser.js
Key findings:
- Shell Command Execution in bin/goreleaser.js: "require('child_process')"
- Rapid Version Publishing
IOCs:
- urls: https://goreleaser.com/static/latest, https://goreleaser.org
- domains: goreleaser.org, goreleaser.com, ip-api.com
- payloadFileHash: 7408b09cf2f23512f20a5012ef156865119858181f3ad970db0cd4c8ed265025
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
8.8/10
High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | goreleaser-run | all (affected) | — |
Aliases
Browse GCVE Records
73,443 records in the GCVE database · Updated July 18, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.