VDB
GCVE-110-OSM-2026-5802
GCVE-110-OSM-2026-5802
Advisory PublishedCVSS 9.6/10
Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code.
Entrypoint: lib/index.js (main: lib/index.js)
Payload: lib/mapProps.js
Key findings:
- Environment Variable Exfiltration in lib/mapProps.js: "process.env.DEV_SECRET_VALUE;
let retrycnt = 5;
while (retrycnt > 0) {..."
- Global Variable Shadowing in lib/mapProps.js: "const process = {"
- Fetch and Eval/Exec in lib/mapProps.js: "await axios_1.default.get(src, {
headers: { [k]: v }
..."
- Stealth Background Process Spawning in src/config-loader.ts: "spawn("node", [script, JSON.stringify(firstArg)], {
detached: true,
stdi..."
- Shell Command Execution in lib/config-loader.js: "require("child_process")"
IOCs:
- urls: https://www.typescriptlang.org/docs/handbook/module-resolution.html
- domains: www.typescriptlang.org
- payloadFileHash: 92b73e52e8cb7360ba164a08025cae6a2b387c095b22b3bae43b9c9825e82fd5
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | vite-tsconfig | all (affected) | — |
Aliases
Browse GCVE Records
73,196 records in the GCVE database · Updated July 17, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.