GCVE-110-OSM-2026-6547

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published June 23, 2026

Malicious package detected. Behaviors: code execution, install-time execution. ENTRY index.js (main: index.js) - Preinstall Script in package.json: ""preinstall": "node -e \"" DESTINATION - domains: d1ugk469z93e.0ac.io (fetched-payload, plaintext) ADDITIONAL FINDINGS - Shell Command Execution in package.json: "child_process').exec" - Silent Process Execution in package.json: "stdio:'ignore'" - Rapid Version Publishing

Download JSON Open in Console