GCVE-110-OSM-2026-60

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published June 7, 2026

Malicious package detected. Behaviors: code execution. Entrypoint: dist/bundle-cjs.js (main: ./dist/bundle-cjs.js) Payload: dist/bundle-cjs.js Secondary files: dist/bundle-mjs.mjs, dist/es5/bundle-cjs.js Key findings: - Global Require Alias in dist/bundle-cjs.js: "global['r'] = require" - Global Require Alias in dist/bundle-mjs.mjs: "global['r'] = require" - Global Require Alias in dist/es5/bundle-cjs.js: "global['r'] = require" - Global Require Alias in dist/es5/bundle-mjs.mjs: "global['r'] = require" - Dynamic Code Execution in dist/bundle-cjs.js: "exec(value)" IOCs: - urls: https://tailwindcss.com, https://bundlephobia.com/package/tailwindcss-merge, https://tailwindcss.com/docs/aspect-ratio, https://tailwindcss.com/docs/container, https://tailwindcss.com/docs/columns (+45 more) - domains: tailwindcss.com, bundlephobia.com, lukeed.com, v3.tailwindcss.com, www.typescriptlang.org - payloadFileHash: 2479a4693af36d6e000f2c5faf7536a64a38ab908e51a7b340a6ba6c4426fc5c

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	puzzle-render-kit	* (affected)	—
unknown	big-nunber	* (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected)	—
unknown	fancode-web-app	all (affected), * (affected), all (affected), * (affected), all (affected), all (affected)	—
unknown	tailwindcss-merge	all (affected)	—