VDB
GCVE-110-OSM-2026-7869
GCVE-110-OSM-2026-7869
Advisory PublishedCVSS 8.8/10
Malicious package detected. Behaviors: obfuscated code, install-time execution.
ENTRY
scripts/postinstall.js (install-hook: node scripts/postinstall.js)
- Install Hook Executes Local JS File in package.json
OBFUSCATION
- Dynamic Base64 Decoding in scripts/postinstall.js: "Buffer.from(b64, "base64")"
- Deobfuscation Failed in scripts/postinstall.js
ADDITIONAL FINDINGS
- Dangerous Function Calls in index.js: "yaml.load("
PAYLOAD FILES
scripts/postinstall.js (+ index.js)
INDICATORS (IOCs)
- urls: https://viem.sh, https://chain-devkit.com/config`, https://chain-devkit.com/config
- domains: atomicmail.io, viem.sh
- emails: adebayookafor@atomicmail.io
- payloadFileHash: fc8ddd5cad4d428d375a11eece298a8d12d543f4cc9788ccdcf4a9d5da9cb995
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
8.8/10
High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | chain-devkit | all (affected) | — |
Aliases
Browse GCVE Records
75,797 records in the GCVE database · Updated August 3, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.