{"id":"MAL-2026-18608","kind":"package","aliases":["MAL-2026-18608"],"related":[],"title":"Malicious code in gugodapis (npm)","description":"Dropper. At run time the package downloads a Windows batch file from a remote URL into the system temporary directory and executes it with child_process.exec. The payload is fetched, not shipped, so the code that runs is controlled by the remote host. Version examined: 1.0.0; tarball SHA-256 ea725cf1c5c950a7a8f091a717cfd2a76e7dd7b81000afe37b7398c76f3c4e3a.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"gugodapis","fixed":[],"affected":"= 1.0.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-02T09:44:21+00:00","first_seen_at":"2026-11-04T09:25:52+00:00","triaged_at":"2026-11-04T09:26:43+00:00","updated_at":"2026-11-04T09:28:08+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18608':8A,11A '-2026':7A,10A '-256':62C '1.0.0':59C 'batch':24C 'child_process.exec':39C 'code':2A,48C 'control':52C 'directori':34C 'download':21C 'dropper':15C 'ea725cf1c5c950a7a8f091a717cfd2a76e7dd7b81000afe37b7398c76f3c4e3a':63C 'examin':58C 'execut':36C 'fetch':43C 'file':25C 'gugodapi':4A 'gugodapis':12A 'host':56C 'mal':6A,9A 'malici':1A,13B 'npm':5A 'packag':14B,20C 'payload':41C 'remot':28C,55C 'run':17C,50C 'sha':61C 'ship':45C 'system':32C 'tarbal':60C 'temporari':33C 'time':18C 'url':29C 'version':57C 'window':23C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["gugodapis"],"ptokens":["gugodapis"],"labels":["critical","malicious","npm","package"],"campaign_type":null,"first_public_at":"2026-11-02T09:44:21+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18608","url":"https://osv.dev/vulnerability/MAL-2026-18608","severity":"critical","published_at":"2026-11-02T09:44:21+00:00","modified_at":"2026-11-04T09:00:05+00:00","first_seen_at":"2026-11-04T09:25:52+00:00","fetched_at":"2026-11-04T09:25:52+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}