GCVE-110-OSM-2026-5851

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published June 13, 2026

Suspected dependency confusion attack. Behaviors: data exfiltration, install-time execution. Entrypoint: index.js (install-hook: node index.js) Payload: index.js Key findings: - Install Hook Executes Local JS File in package.json: ""preinstall": "node index.js"" - Brand New Package - Very New NPM Publisher Account IOCs: - payloadFileHash: ffc70b06e46b3e824cc8886362c0a7d50969220216d5b94993b00f3be13ac852

Download JSON Open in Console