GCVE-110-OSM-2026-5800

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published June 12, 2026

APT malware detected: chai-max. Associated with threat actor(s): DPRK/Lazarus. Behaviors: data exfiltration, code execution, obfuscated code, install-time execution. Entrypoint: dist/cli.js (bin: ./dist/cli.js) Exfil: https://huggingface.co/api/repos/create (reconstructed, recovery: reconstructed in dist/node/payload.js) Payload: dist/node/payload.js Key findings: - Cryptocurrency Wallet Theft in dist/node/payload.js: "wallet.dat" - Download Execute Delete Pattern in dist/node/payload.js: "writeFileSync(jsPath, buffer); logger_js_1.logger.info({ version: remo..." - Chai-Max Wallet Theft Indicators in dist/node/payload.js: ".exodus" - Reconstructed Obfuscated URL in dist/node/payload.js: "https://huggingface.co/api/repos/create" - Stealth Background Process Spawning in dist/node/utils.js: "spawn(process.execPath, [script, "--bg"], { detached: true, stdio: "..." IOCs: - ipv4: 4.0.0.0 - domains: matteocollina.com, Crypto.com, huggingface.co - emails: hello@matteocollina.com - urls: https://huggingface.co/api/repos/create - payloadFileHash: 91854e0283c8bbccbe9a18b9f42077aeb0709f5fb7731e7183e63ec263f80a06

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	index-ulid	all (affected)	—

References

Malicious npm package: index-ulid

advisory

vendor

Browse GCVE Records

73,738 records in the GCVE database · Updated July 19, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON