{"dataType":"CVE_RECORD","dataVersion":"1.0","cveMetadata":{"cveId":"GCVE-110-OSM-2026-14453","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-08-04T00:00:00Z","dateUpdated":"2026-11-04T03:59:58Z","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"en","value":"Compromised npm package infected via worm propagation in the Shai-Hulud/ChainDrop supply chain attack (Aug 4, 2026). Malicious versions contain obfuscated preinstall scripts (setup.mjs, math_init.js) that download the Bun runtime and execute a credential-harvesting payload targeting npm tokens, GitHub tokens, AWS credentials, Kubernetes secrets, Vault tokens, Stripe keys, Slack tokens, SSH keys, and sensitive files. Exfiltrates encrypted data via Ethereum dead-drop C2.\n\nMalicious payload found in: setup.mjs, math_init.js\\nTrigger: preinstall script in package.json\\nBehavior: Downloads Bun runtime, executes obfuscated infostealer payload targeting npm/GitHub/AWS/K8s/Vault/Stripe/Slack credentials and sensitive files. Exfiltrates via Ethereum dead-drop C2. Self-propagating worm infects other maintainers packages.\\nCompromised versions: 0.0.12","supportingMedia":null}],"references":[{"url":"https://opensourcemalware.com/threats/047dfe02-a1d6-487e-9259-c5e282f6dac0","name":"Malicious npm package: server-hemera-mongo","tags":["advisory"]},{"url":"https://registry.npmjs.org/server-hemera-mongo","name":"","tags":["vendor"]}],"metrics":[{"format":"CVSS_V3","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","baseScore":8.8,"baseSeverity":"HIGH"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Embedded Malicious Code","cweId":"CWE-506","type":"CWE"}]}],"affected":[{"vendor":"unknown","product":"server-hemera-mongo","collectionURL":"https://registry.npmjs.org","packageName":"server-hemera-mongo","repo":"","defaultStatus":"affected","versions":[{"version":"0.0.12","status":"affected","versionType":"","lessThan":"","lessThanOrEqual":"","changes":null}],"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null},"adp":null}}