GCVE-110-OSM-2026-9310

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published July 18, 2026

Malicious package detected. Behaviors: network activity, obfuscated code. ENTRY devnet/bitcannadevnet2/index.js (main: index.js) DESTINATION - ethereumAddresses: 0x2Cbea61fdfDFA520Ee99700F104D5b75ADf50B0c (exfil, plaintext) - ethereumAddresses: 0xAE6D3334989a22A65228732446731438672418F2 (exfil, plaintext) - ethereumAddresses: 0xa0b86991c6218b36c1d19d4a2e9eb0ce3606eb48 (exfil, plaintext) - ethereumAddresses: 0x853d955acef822db058eb8505911ed77f175b99e (exfil, plaintext) - ethereumAddresses: 0x6b175474e89094c44da98b954eedeac495271d0f (exfil, plaintext) - ethereumAddresses: 0xdac17f958d2ee523a2206206994597c13d831ec7 (exfil, plaintext) - ethereumAddresses: 0xc02aaa39b223fe8d0a0e5c4f27ead9083c756cc2 (exfil, plaintext) - ethereumAddresses: 0x2260fac5e5542a773aa44fbcfedf7c193bc2c599 (exfil, plaintext) (+42 more) EXFIL - Suspicious Domain in devnet/bitwaydevnet/chain.js: "http://45.77.249.30" - Suspicious Domain in devnet/prysmdevnet/chain.js: "http://144.76.70.103" - Suspicious Domain in esm/devnet/bitwaydevnet/chain.js: "http://45.77.249.30" - Suspicious Domain in esm/devnet/prysmdevnet/chain.js: "http://144.76.70.103" - Suspicious Domain in esm/mainnet/bluechip/chain.js: "https://bluechipsblockexplorer.com" - Suspicious Domain in esm/mainnet/chain4energy/chain.js: "http://185.245.182.192" - Suspicious Domain in esm/mainnet/cifer/chain.js: "http://119.59.126.109" - Suspicious Domain in esm/mainnet/humans/chain.js: "http://65.21.46.90" (+14 more) OBFUSCATION - Base64 Encoded Payload in esm/mainnet/gateway/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/46Y..." - Base64 Encoded Payload in esm/mainnet/injective/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in esm/mainnet/kujira/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in esm/mainnet/osmosis/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in mainnet/gateway/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/46Y..." - Base64 Encoded Payload in mainnet/injective/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in mainnet/kujira/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." - Base64 Encoded Payload in mainnet/osmosis/asset-list.js: "'factory/wormhole14ejqjyq8um4p3xfqj74yld5waqljf88fz25yxnma0cngspxe3les00fpjx/8sY..." ADDITIONAL FINDINGS - Suspicious TLD Domain in devnet/prysmdevnet/chain.js: "https://rpc-prysm.vinjan.xyz" - Rapid Version Publishing PAYLOAD FILES devnet/prysmdevnet/chain.js (+ esm/devnet/prysmdevnet/chain.js, esm/mainnet/chain4energy/chain.js) INDICATORS (IOCs) - ipv4: 45.77.249.30, 144.76.70.103, 63.250.41.78, 185.245.182.192, 89.117.58.109 (+16 more) - urls: https://constructive.io, https://hyperweb.io, https://rpc-devnet-6.bitcanna.io/, http://devnet-6.bitcanna.io:9090, https://lcd-devnet-6.bitcanna.io/ (+45 more) - domains: constructive.io, 2Fraw.githubusercontent.com, hyperweb.io, devnet.bitway.com, validator-1.celestia-arabica-11.com (+26 more) - emails: developers@constructive.io - sha256Hashes: F082B65C88E4B6D5EF1DB243CDA1D331D002759E938A0F5CD3FFDC5D53B3E349, 1BCF1FCAFE3568E234787EDFDA12460BD8931B17FE6A729DCD60FAD845558DA1, 43897B9739BD63E3A08A88191999C632E052724AB96BD4C74AE31375C991F48D, 3F882513A0CCD1C4110ACB7C6C761AC7B48974C9D2D439CD6F652F9B44362518, 7364C29ED876F05A82628B738AA2F0D53724991FD0220858570D7A3844B67F58 (+45 more) - payloadFileHash: 7bdf61eb4a03859b31ea1032008441e7419f706a5426a83064167666adaea96e

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	theta-registry	all (affected)	—

References

Malicious npm package: theta-registry

advisory

vendor

Browse GCVE Records

75,874 records in the GCVE database · Updated August 4, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON