GCVE-110-OSM-2026-6238

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published June 18, 2026

Malicious package detected. Behaviors: code execution. ENTRY dist/index.cjs (main: ./dist/index.cjs) ADDITIONAL FINDINGS - Global Require Alias in dist/index.d.cts: "global['r']=require" - Very New NPM Publisher Account - Rapid Version Publishing PAYLOAD FILES dist/index.d.cts (+ dist/index.d.ts) INDICATORS (IOCs) - urls: https://standardschema.dev, https://emailregex.com/, https://effectivetypescript.com/2022/02/25/gentips-4-display/, https://zelark.github.io/nano-id-cc - domains: standardschema.dev, emailregex.com, effectivetypescript.com, zelark.github.io - payloadFileHash: 212a5335330346ef640e06187387cf7cdffc2fc3e3942bfcf59b1b2d03cd83b9

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	typedecode	1.0.3 (affected)	—

References

Malicious npm package: typedecode

advisory

vendor

Browse GCVE Records

72,921 records in the GCVE database · Updated July 15, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON