GCVE-110-OSM-2026-6460

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published June 19, 2026

Malicious package detected. Behaviors: data exfiltration, code execution, install-time execution. ENTRY scripts/postinstall.js (install-hook: node scripts/postinstall.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: 114.67.90.67 (primary, plaintext) in scripts/shell.js EXFIL - System Information Collection in scripts/shell.js: "os.platform()" ADDITIONAL FINDINGS - Stealth Background Process Spawning in scripts/postinstall.js: "spawn(process.execPath, [path.join(__dirname, 'shell.js')], { detached: true, st..." - Shell Command Execution in scripts/postinstall.js: "require('child_process')" - Silent Process Execution in scripts/postinstall.js: "stdio: 'ignore'" - Detached Child Process Payload in scripts/postinstall.js: "spawn(process.execPath, [path.join(__dirname, 'shell.js')], { detached: true" PAYLOAD FILES scripts/postinstall.js (+ scripts/shell.js) INDICATORS (IOCs) - payloadFileHash: 20d2859a52b6f2bf12083b85a9332ef9c4be9dbdceab735e0789c7f15bb5a5c7

Download JSON Open in Console