VDB
GCVE-110-OSM-2026-6713
GCVE-110-OSM-2026-6713
Advisory PublishedCVSS 8.8/10
Malicious package detected. Behaviors: data exfiltration, code execution, network activity.
ENTRY
index.js (bin: ./index.js)
DESTINATION
- custom-c2: http://151.244.40.74:4000 (primary, plaintext) in index.js
- custom-c2: 151.244.40.74 (plaintext) in index.js
EXFIL
- System Information Collection in index.js: "os.userInfo()"
- Suspicious Domain in index.js: "http://151.244.40.74"
ADDITIONAL FINDINGS
- Dynamic Code Execution in index.js: "exec(resposta)"
- Shell Command Execution in index.js: "execSync("
- Shell Command Variable Setup in index.js: ""cmd.exe" : "/bin/sh""
- Brand New Package
- Rapid Version Publishing
PAYLOAD FILES
index.js
INDICATORS (IOCs)
- payloadFileHash: f6e7560120f5948ee90177ccaf8a6d65533f505afbd3c77a508c107ba351937e
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
8.8/10
High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | hydanlabs | 1.4.0 (affected) | — |
Aliases
Browse GCVE Records
74,355 records in the GCVE database · Updated July 23, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.