VDB

GCVE-110-OSM-2026-681

GCVE-110-OSM-2026-681
Advisory PublishedCVSS 9.6/10
Vulnetix · Advisory published June 10, 2026
This GitHub repository contains malicious code that will steal cryptocurrency tokens, cookies and other sensitive data. This repo was used in a LinkedIn fake recruiter campaign that has been attributed to the North Korean APT Lazarus Group. The payload is a javascript component that tricks the user into running it as part of a web application, and when the user browses to the locally running version of the app, the compromised code steals browser tokens, cookies, etc.
Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

VendorProductVersionsPlatforms
unknownnfdall (affected)—
unknownall (affected)—

Aliases

MAL-2026-1411

References

Malicious pypi package: nfd
advisory
advisory
vendor
Malicious repository: https://github.com/Ventionss/socifi-mvp-v1-update
advisory
vendor

Browse GCVE Records

74,352 records in the GCVE database · Updated July 22, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON
$ Console Community · 100/wk Open console ›