GCVE-110-OSM-2026-7507

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published July 8, 2026

Malicious package detected. Behaviors: code execution, install-time execution. ENTRY index.js (install-hook: node index.js) - Install Hook Executes Local JS File in package.json ADDITIONAL FINDINGS - Download Execute Delete Pattern in index.js: "execSync(_0xg, { stdio: 'pipe', timeout: 60000 }); if (_0xf.existsSync(_0xd)) { ..." - Shell Command Execution in index.js: "require('child_process')" PAYLOAD FILES index.js INDICATORS (IOCs) - payloadFileHash: 62ccc1e4162c4fbca1883412ca7b502200a799fb01219a5f2297c2882f449807

Download JSON Open in Console