GCVE-110-OSM-2026-8342

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published July 17, 2026

Suspected dependency confusion attack. Behaviors: code execution, obfuscated code. ENTRY https-dev-patch/index.js (main: index.js) OBFUSCATION - Decoded Base64 Content in https-dev-patch/index.js - Decoded Base64 Content in [deobfuscated] https-dev-patch/index.js - Dynamic Base64 Decoding in https-dev-patch/index.js: "eval(atob" - Obfuscation: augmented proxied array function replacements in https-dev-patch/index.js - Obfuscation: augmented proxied array function replacements in index.js - Decoded Hex Escape Content in index.js (x250) - Base64 Encoded Payload in https-dev-patch/index.js: "'ZnVuY3Rpb24gXzB4MzlkNShfMHg1NmY5NTMsXzB4NGZhMjFiKXtjb25zdCBfMHg0YmIxOGI9XzB4NGJ..." - Hex Encoded Strings in index.js: "'\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x7..." (+6 more) ADDITIONAL FINDINGS - Base64 Decoded Eval in https-dev-patch/index.js: "eval(atob(" PAYLOAD FILES index.js INDICATORS (IOCs) - domains: discord.com - payloadFileHash: 9c4c5904f7bd39b66e854c60708bc5d732cf13e51c1b1b3e19b6ae64eddb1736

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	og-boost-br	all (affected)	—

References

Malicious npm package: og-boost-br

advisory

vendor

Browse GCVE Records

75,801 records in the GCVE database · Updated August 3, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON