GCVE-110-OSM-2026-9092

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published July 26, 2026

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY dist/esm/index.js (default-index: index.js) DESTINATION - custom-c2: https://apt.coin.ledger.com/node/v1 (primary, plaintext) in dist/cjs/Eth-D3mrx1hw.cjs - custom-c2: https://apt.coin.ledger-stg.com/node/v1 (plaintext) in dist/cjs/Eth-D3mrx1hw.cjs - custom-c2: https://apt.coin.ledger.com/node/v1/graphql (plaintext) in dist/cjs/Eth-D3mrx1hw.cjs - custom-c2: https://apt.coin.ledger-stg.com/node/v1/graphql (plaintext) in dist/cjs/Eth-D3mrx1hw.cjs - custom-c2: https://algorand.coin.ledger.com (plaintext) in dist/cjs/Eth-D3mrx1hw.cjs - custom-c2: https://celo.coin.ledger.com/indexer/ (plaintext) in dist/cjs/Eth-D3mrx1hw.cjs - custom-c2: https://celo.coin.ledger.com/archive/ (plaintext) in dist/cjs/Eth-D3mrx1hw.cjs - custom-c2: https://filecoin.coin.ledger.com (plaintext) in dist/cjs/Eth-D3mrx1hw.cjs (+130 more) EXFIL - Data Encoding for Exfiltration in dist/cjs/Eth-D3mrx1hw.cjs: "encodeURIComponent(utf8Str" - Data Encoding for Exfiltration in dist/esm/Eth-3DsLUPcu.js: "encodeURIComponent(utf8Str" - Network Request in dist/esm/Eth-3DsLUPcu.js: "axios.get(" OBFUSCATION - Dynamic Base64 Decoding in dist/cjs/Eth-D3mrx1hw.cjs: "Buffer.from(erc20SignaturesBlob, "base64")" - Dynamic Base64 Decoding in dist/esm/Eth-3DsLUPcu.js: "Buffer.from(erc20SignaturesBlob, "base64")" - Base64 Encoded Payload in dist/cjs/Eth-D3mrx1hw.cjs: ""3044022014391e8f355867a57fe88f6a5a4dbcb8bf8f888a9db3ff3449caf72d120396bd02200c1..." - Base64 Encoded Payload in dist/cjs/eip712-Bk2Qid4k.cjs: ""3044022020da162d81217220a0ae92baec05c5e99cbb391469186e27b2609740980c7dff0220285..." - Base64 Encoded Payload in dist/cjs/eip712_v2-Bjd37-ga.cjs: ""3044022020da162d81217220a0ae92baec05c5e99cbb391469186e27b2609740980c7dff0220285..." - Base64 Encoded Payload in dist/cjs/evm-BQn8Qolv.cjs: ""304402200ae8634c22762a8ba41d2acb1e068dcce947337c6dd984f13b820d39617695230220330..." - Base64 Encoded Payload in dist/esm/Eth-3DsLUPcu.js: ""3044022014391e8f355867a57fe88f6a5a4dbcb8bf8f888a9db3ff3449caf72d120396bd02200c1..." - Base64 Encoded Payload in dist/esm/eip712-Df6GvAWb.js: ""3044022020da162d81217220a0ae92baec05c5e99cbb391469186e27b2609740980c7dff0220285..." (+7 more) ADDITIONAL FINDINGS - Dynamic Code Execution in dist/cjs/semver-BS6Uk1CY.cjs: "exec(version)" PAYLOAD FILES dist/esm/Eth-3DsLUPcu.js (+ dist/cjs/Eth-D3mrx1hw.cjs, dist/cjs/semver-BS6Uk1CY.cjs) INDICATORS (IOCs) - urls: https://injectivelabs.org/, https://docs.ts.injective.network/wallet/wallet-wallet-strategy, https://injective.com, https://t.me/joininjective - domains: injectivelabs.org, docs.ts.injective.network, injective.com, iili.io - emails: admin@injectivelabs.org - sha256Hashes: 0101010101010101010101010101010101010101010101010101010101010101, 0202020202020202020202020202020202020202020202020202020202020202, 87020e80af6e07a6e4697f091eacadb9e7e6629cb7e5a8a371689a3ed53b3d64 - payloadFileHash: ab005f90ecf524002fd7035c435435f1b4a12670c4568dfb25aaa1b800c371a7

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	@injectivelabs/wallet-ledger	1.20.21 (affected)	—

References

Malicious npm package: @injectivelabs/wallet-ledger

advisory

vendor

Browse GCVE Records

76,198 records in the GCVE database · Updated August 6, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON