GCVE-110-OSM-2026-8887

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published July 21, 2026

Malicious package detected. Behaviors: code execution, obfuscated code. ENTRY index.js (main: index.js) OBFUSCATION - Hex Encoded Strings in lib/config.js: "'\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x7..." - Unicode Escape Obfuscation in lib/config.js: "\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74..." - Obfuscation: obfuscator.io in lib/config.js - Obfuscation patterns: hexHeavy in lib/config.js ADDITIONAL FINDINGS - Shell Command Execution in index.js: "require('child_process')" - Dynamic Code Execution in lib/redaction.js: "exec(str)" - Very New NPM Publisher Account PAYLOAD FILES lib/redaction.js (+ lib/config.js) INDICATORS (IOCs) - urls: http://192.168.1.42:9200 - domains: LR.sE, LR.sh, LR.se, LR.sH - payloadFileHash: 35126406320c98554ce69c350858a01a061c9a37db363cd7b57156bbf7305821

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	chai-leaf	all (affected)	—

References

Malicious npm package: chai-leaf

advisory

vendor

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON