GCVE-110-OSM-2026-6141

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published June 18, 2026

Malicious package detected. Behaviors: code execution, obfuscated code. ENTRY src/index.ts (main: src/index.ts) DESTINATION - urls: http://x (c2, plaintext) - webhookServices: https://webhook.site/abc. (exfil, plaintext) - webhookServices: https://webhook.site/abc (exfil, plaintext) OBFUSCATION - Dynamic Base64 Decoding in src/index.ts: "Buffer.from(blob, "base64")" - Decoded URL Encoded Content in src/index.ts ADDITIONAL FINDINGS - Dynamic Code Execution in src/index.ts: "exec(text)" PAYLOAD FILES src/index.ts INDICATORS (IOCs) - urls: https://crewhaus.ai, https://requestcatcher.com/example - domains: requestcatcher.com, crewhaus.ai - emails: max@crewhaus.ai - payloadFileHash: 82eb3ccad5259f28128b14dbbf49e8a62278014c41387fe897e3557e2de2358e

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	@crewhaus/prompt-injection-detector	all (affected)	—

References

Malicious npm package: @crewhaus/prompt-injection-detector

advisory

vendor

Browse GCVE Records

73,738 records in the GCVE database · Updated July 19, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON