VDB
GCVE-110-OSM-2026-6432
GCVE-110-OSM-2026-6432
Advisory PublishedCVSS 9.6/10
Malicious npm package @thymelab/logfx (2.15.3-2.15.6) in the Operation Friday Harvest campaign. An obfuscated install loader (dist/bootstrap.js (282,149 B)) downloads and detaches a Rust infostealer (GitHub release) that exfiltrates credentials, crypto wallets, and cloud keys to the Telegram Bot API.
Malicious payload found in: dist/bootstrap.js (282,149 B)
Obfuscation build-cluster: C (_0x175f / __38CC632841_TAG)
Threat-actor maintainer: thymelab-v0et8w@wshu.net | author: thymelab@pm.me
Drops Rust infostealer from: https://github.com/angelmaybeth21-oss/test/releases/download/v1.0.0/{linux,mac,win.js}
SHA-256 linux ELF: 2457b2e775a5fe7a9e022ba77074a1b9aacb41b4fc0cc1d8a3dc66546599c5de
SHA-256 macOS Mach-O: b1c7b17f31a84e2596250121c3610ae5e0d592651940dd6c0dd74506f0f38313
SHA-256 win.js: 11fe3a47333f63fd0e0a32ea16351eb302659aba983c07e4ea3dc9b09b618509
C2/exfil: HTTPS POST to api.telegram.org (Telegram Bot API, IP 149.154.166.110)
Behavior: harvests browser creds, 30+ crypto wallets, SSH keys, AWS/GCP/Azure/K8s creds, DB client configs; systemd-user persistence.
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | @thymelab/logfx | all (affected) | — |
Browse GCVE Records
72,664 records in the GCVE database · Updated July 15, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.