GCVE-110-OSM-2026-8133

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published July 16, 2026

Malicious package detected. Behaviors: data exfiltration. ENTRY dist/index.js (main: ./dist/index.js) DESTINATION - custom-c2: https://api.deployowl.com (primary, plaintext) in dist/index.js - custom-c2: api.deployowl.com (plaintext) in dist/index.js EXFIL - Environment Variable Exfiltration in dist/index.js: "process.env.NODE_ENV==="development"&&console.error("[DeployOwl] Failed to send ..." - Environment Variable Exfiltration in dist/index.mjs: "process.env.NODE_ENV==="development"&&console.error("[DeployOwl] Failed to send ..." - System Information Collection in dist/index.js: "process.platform" - System Information Collection in dist/index.mjs: "process.platform" ADDITIONAL FINDINGS - Publisher Shows Burner-Account Pattern PAYLOAD FILES dist/index.js (+ dist/index.mjs) INDICATORS (IOCs) - urls: https://custom.com - domains: custom.com - payloadFileHash: ce7da957913b0be4e8dcad76dac2493f5ec02af512dc3c12a33274756b080627

Download JSON Open in Console