GCVE-110-OSM-2026-90

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published June 5, 2026

Malicious package detected. Behaviors: data exfiltration, code execution. Entrypoint: bin/cli.js (bin: bin/cli.js) Payload: src/formatters/table.js Secondary files: src/extractors/js-bundle.js, src/extractors/package-json.js Key findings: - Corporate Environment Targeting in src/formatters/table.js: "magenta("npx-confusion"); case "bin-mismatch": return chalk.magenta("b..." - Dynamic Code Execution in src/extractors/js-bundle.js: "exec(content)" - Dynamic Code Execution in src/extractors/package-json.js: "exec(scriptValue)" - Data Encoding for Exfiltration in src/registries/npm.js: "encodeURIComponent(name" - Dynamic Code Execution in src/sources/web.js: "exec(html)" IOCs: - urls: https://www.landh.tech/blog/20260521-npx-used-confusion-and-its-super-effective/, https://pipedream.com/, https://ngrok.com/ - domains: www.landh.tech, scripts.dev, pipedream.com, ngrok.com, npmmirror.com - webhookServices: https://webhook.site/)** - payloadFileHash: b887384114753105349147f309f78e77a9e4401f7036a129a1d6b773afac6d15

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	add-react-displayname	all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected)	—
unknown	cit-playwright-tests	all (affected), * (affected), all (affected), all (affected), * (affected), * (affected)	—
unknown	@emilgroup/tenant-sdk-node	all (affected)	—
unknown	npxconfuse	all (affected)	—
unknown	@emilgroup/process-manager-sdk-node	all (affected)	—