VDB
GCVE-110-OSM-2026-613
GCVE-110-OSM-2026-613
Advisory PublishedCVSS 5.4/10
Malicious vscode tasks.json file that delivers malware via GitHooks, when the user opens the repository using visual studio code.
Post checkout githook is triggered by tasks.json file.
The initial C2 hosted at https[://]ninjacode-gitconfig-v1[.]vercel[.]app/settings/mac?token=6c1d60d35852ef0c05df
At the time of this report, the said C2 url returning 404, however attacker host infrastructure is still active, not taken down by the hosting provider.
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
5.4/10
Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | pulse-feature-flag | all (affected), all (affected), * (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected) | — |
| unknown | all (affected) | — | |
| unknown | pulse-rsvp-card-entity | all (affected), all (affected), all (affected), all (affected) | — |
| unknown | shakti-pwa | all (affected), all (affected) | — |
References
Malicious npm package: shakti-pwa
advisory
Browse GCVE Records
72,337 records in the GCVE database · Updated July 14, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.