# sonatype-2020-1096

wsbd.js, ac-addon, discord.app - "CursedGrabber" malware family

Published Nov 9, 2020

## Security Details
### CVE ID
sonatype-2020-1096

### CVE Description
wsbd.js, ac-addon, discord.app - "CursedGrabber" malware family

### CVSS Score & Severity
**CVSS Score**: 10.0 Critical

### CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

### EPSS Score
0%

### KEV Status
Not in KEV Catalog: No known exploits

### Affected Ecosystems
affected

### Source
Sonatype

### References
- [Sonatype Blog - discord.dll successor to npm fallguys](https://blog.sonatype.com/discord.dll-successor-to-npm-fallguys-)
- [Sonatype Blog - npm malware xpc.js](https://blog.sonatype.com/npm-malware-xpc.js)
- [OSV - MAL-2025-13963](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-13963.json)
- [OSV - MAL-2025-18478](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-18478.json)
- [OSV - MAL-2025-39498](https://osv-vulnerabilities.storage.googleapis.com/npm/MAL-2025-39498.json)