GCVE-110-OSM-2026-8911

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published July 22, 2026

Malicious package detected. Behaviors: obfuscated code, install-time execution. ENTRY dist/index.d.js (install-hook: node ./dist/index.d.js) - Install Hook Executes Local JS File in package.json DESTINATION - deobfuscated: everydaynodechecker-39143n.vercel.app (fetched-payload, deobfuscated) OBFUSCATION - Global Variable Shadowing in dist/index.d.js: "const require = (" - Decoded Base64 Content in dist/index.d.js - Decoded Base64 Content in [deobfuscated] dist/index.d.js - IOCs Found in Deobfuscated Code in dist/index.d.js - Dynamic Base64 Decoding in dist/index.d.js: "Buffer.from(b4, "base64")" - Base64 Encoded Payload in dist/index.d.js: "'KGFzeW5jICgpID0+IGV2YWwoIGF3YWl0IGZldGNoKCdodHRwczovL2V2ZXJ5ZGF5bm9kZWNoZWNrZXI..." - recovered 2 urls, 2 domains, 1 _domainCandidates from decoded/deobfuscated content PAYLOAD FILES dist/index.d.js INDICATORS (IOCs) - urls: https://everydaynodechecker-39143n.vercel.app/api/key?mem=root1 - payloadFileHash: 6a19681ca31fb7be2fea7d7e0644fb5c64249dfb64a1cf2ad189a11f4cc05292

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	react-tabulix-extended	all (affected)	—

References

Malicious npm package: react-tabulix-extended

advisory

vendor

Browse GCVE Records

75,874 records in the GCVE database · Updated August 4, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON