VDB
GCVE-110-OSM-2026-7683
GCVE-110-OSM-2026-7683
Advisory PublishedCVSS 9.6/10
Malicious package detected.
ENTRY
index.js (default-index: index.js)
OBFUSCATION
- Decoded Base64 Content in index.js
- recovered 1 urls, 1 domains from decoded/deobfuscated content
ADDITIONAL FINDINGS
- Very New NPM Publisher Account
- Publisher Has Other Malicious Packages
PAYLOAD FILES
index.js
INDICATORS (IOCs)
- urls: http://tjholowaychuk.com, https://cookie-api-two.vercel.app/
- domains: vision-media.ca, somethingdoug.com, tjholowaychuk.com, cookie-api-two.vercel.app
- emails: tj@vision-media.ca, doug@somethingdoug.com
- payloadFileHash: 63618533e52508d7588b12f5ce3916873e5395db5200f7541eaf84c1291d1aad
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | cookie-parser-js | 1.5.2 (affected) | — |
Aliases
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.