VDB
GCVE-110-OSM-2026-7652
GCVE-110-OSM-2026-7652
Advisory PublishedCVSS 9.6/10
Suspected dependency confusion attack.
ENTRY
index.js (main: index.js)
- URL-Based Dependency in package.json: ""dependencies": { "axios": "^1.7.9", "lodash": "^4.17.21", "node-fetch": "^3.3.2..."
- URL-Based Dependency in [rallycoding] package.json: ""dependencies": { "axios": "^1.7.9", "lodash": "^4.17.11", "node-fetch": "^3.3.2..."
DESTINATION
- urls: http://pack.nppacks.com/npm/rallycoding (loader, plaintext)
- domains: pack.nppacks.com (loader, plaintext)
OBFUSCATION
- recovered 2 urls, 2 domains from decoded/deobfuscated content
ADDITIONAL FINDINGS
- Brand New Package
PAYLOAD FILES
[rallycoding] package.json
INDICATORS (IOCs)
- urls: http://pack.nppacks.com/npm/idle-style-xi
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | rallycoding | all (affected) | — |
Aliases
Browse GCVE Records
73,443 records in the GCVE database · Updated July 18, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.