GCVE-110-OSM-2026-7587

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published July 8, 2026

Malicious package detected. Behaviors: data exfiltration, obfuscated code, install-time execution. ENTRY src/core/index.js (install-hook: node ./src/core/index.js) - Install Hook Executes Local JS File in package.json DESTINATION - custom-c2: chain.fun (primary, plaintext) in src/core/index.js EXFIL - Network Request in src/core/index.js: "axios.get(" OBFUSCATION - Decoded Base64 Content in src/core/config.js (x2) - Dynamic Base64 Decoding in src/core/index.js: "atob(apiKey)" - Deobfuscation Failed in src/core/index.js - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Detached Child Process Payload in src/core/index.js: "spawn('node', [], { detached: true" - Brand New Package PAYLOAD FILES src/core/config.js INDICATORS (IOCs) - urls: https://jsonlines.org/, https://uhop.github.io/wiki-search/app/?wiki=uhop/stream-chain, https://jsonkeeper.com/b/TW6AR - domains: jsonlines.org, uhop.github.io, jsonkeeper.com - payloadFileHash: d23123ff15df7b933a1ccca715cb289dd1a5e390c7244e8a9c2a767e9a9ccf28

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	mchain-sdk	4.2.5 (affected)	—

References

Malicious npm package: mchain-sdk

advisory

vendor

Browse GCVE Records

73,118 records in the GCVE database · Updated July 16, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON