VDB
GCVE-110-OSM-2026-6668
GCVE-110-OSM-2026-6668
Advisory PublishedCVSS 9.6/10
Malicious package detected. Behaviors: code execution, obfuscated code.
ENTRY
src/cjs/index.cjs (main: src/cjs/index.cjs)
DESTINATION
- telegram-bot: api.telegram.org/bot7837266935:AAEx4l6XEaurITplCmDHMoB-Dm0KfXnwOw0/sendMessage (primary, deobfuscated) in src/cjs/index.cjs
OBFUSCATION
- IOCs Found in Deobfuscated Code in src/cjs/index.cjs
- Base64 Encoded Payload in src/esm/index.js: "'qqtZ7M8CAh4IrAFodHRwczovL2FwaS50ZWxlZ3JhbS5vcmcvYm90ODg4MDAyMDg0MDpBQUZnUzUwNmo..."
- String Array Obfuscation in src/esm/index.js: "fg[ft - 0x1]"
- Obfuscation patterns: hexVariables in src/cjs/index.cjs
- Obfuscation patterns: debuggerTraps, hexHeavy in src/esm/index.js
- recovered 1 telegramApi from decoded/deobfuscated content
ADDITIONAL FINDINGS
- Indirect Function Constructor Access in src/esm/index.js: "['constructor']"
- Brand New Package
- Publisher Shows Burner-Account Pattern
- Rapid Version Publishing
PAYLOAD FILES
src/cjs/index.cjs
INDICATORS (IOCs)
- payloadFileHash: aa334bbc9ede672962ce01c1c7507eaab5f6a4e3d2968174985500863d04bad7
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | base62-86x | 5.0.5 (affected) | — |
Aliases
Browse GCVE Records
74,267 records in the GCVE database · Updated July 22, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.