GCVE-110-OSM-2026-6230

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published June 18, 2026

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code. ENTRY src/index.js (main: ./src/index.js) EXFIL - Environment Variable Exfiltration in src/features/define.js: "JSON.stringify(process.env)" - Environment Variable Exfiltration in src/features/extras/config.js: "process.env.DEV_SECRET_KEY; const v = process.env.DEV_SECRET_VALUE; let retrycnt..." - Fetch and Eval/Exec in src/features/extras/config.js: "axios.get(src, { headers: { [k]: v } })).data.config; const require = createRequ..." - Payload Download from Paste Service in src/features/extras/config.js: "jsonkeeper.com" - Network Request in src/features/extras/config.js: "axios.get(" OBFUSCATION - Global Variable Shadowing in src/features/extras/config.js: "const process = {" - Strings Extracted from Deobfuscated Code in src/features/extras/config.js ADDITIONAL FINDINGS - Dynamic Code Execution in src/features/extras/config.js: "new Function("require", s)" - Very New NPM Publisher Account PAYLOAD FILES src/features/extras/config.js INDICATORS (IOCs) - payloadFileHash: d2c9cc973ef588acad719b4a4d8dcd6d088f224450b9ef9eeb717b8c9f3d64ba

Download JSON Open in Console