VDB
GCVE-110-OSM-2026-7098
GCVE-110-OSM-2026-7098
Advisory PublishedCVSS 9.6/10
Malicious package detected. Behaviors: code execution, obfuscated code.
ENTRY
src/cjs/index.cjs (main: src/cjs/index.cjs)
OBFUSCATION
- Base64 Encoded Payload in src/cjs/index.cjs: "'Pj8HLLkCAiQIQmh0dHA6Ly8xNjguMjMxLjgxLjgwOjMwMDEvYXBpL2xvZwgIUE9TVAgMbWV0aG9kCCB..."
- String Array Obfuscation in src/cjs/index.cjs: "kr[kj - 0x1]"
- Base64 Encoded Payload in src/esm/index.js: "'Pj8HLLkCAiQIQmh0dHA6Ly8xNjguMjMxLjgxLjgwOjMwMDEvYXBpL2xvZwgIUE9TVAgMbWV0aG9kCCB..."
- String Array Obfuscation in src/esm/index.js: "kr[kj-0x1]"
- Obfuscation patterns: debuggerTraps, hexHeavy in src/cjs/index.cjs
- Obfuscation patterns: debuggerTraps, hexHeavy in src/esm/index.js
ADDITIONAL FINDINGS
- Publisher Has Other Malicious Packages
- Indirect Function Constructor Access in src/cjs/index.cjs: "['constructor']"
- Brand New Package
PAYLOAD FILES
src/cjs/index.cjs (+ src/esm/index.js)
INDICATORS (IOCs)
- payloadFileHash: b9196913222886e67e5002f7ab12f12bbf2bba656c92a53433d3a0bbd80cfb65
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | base65-85x | 5.0.1 (affected) | — |
Aliases
Browse GCVE Records
74,585 records in the GCVE database · Updated July 24, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.