GCVE-110-OSM-2026-105

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published June 9, 2026

Malicious package detected. Behaviors: data exfiltration, code execution. Entrypoint: spaysdata/main.py (console-script: spaysdata-run=spaysdata.main:main_entry) Exfil: https://discord.com/api/webhooks/1499336276762038292/h4ATCu-rQOlwnB0ArhAnGzIji5Zw-EcqU8cRSNwubh15x7n7niYxpSTrzAg0GDG8ybQL (discord-webhook, recovery: plaintext in spaysdata/main.py) Payload: spaysdata/main.py Key findings: - Webhook Data Exfiltration in spaysdata/main.py: "discord.com/api/webhooks/1499336276762038292/h4ATCu-rQOlwnB0ArhAnGzIji5Zw-EcqU8c..." - Discord Token Theft in spaysdata/main.py: "discord\\Local Storage" - Shell Command Execution in spaysdata/main.py: "os.system(" - Data Encoding for Exfiltration in spaysdata/main.py: "base64.b64encode(" IOCs: - urls: https://discordapp.com/api/v6/users/@me - domains: discordapp.com - discordWebhooks: https://discord.com/api/webhooks/1499336276762038292/h4ATCu-rQOlwnB0ArhAnGzIji5Zw-EcqU8cRSNwubh15x7n7niYxpSTrzAg0GDG8ybQL - payloadFileHash: 77e2aaa0ecbba755c48dc5987789afbe7432d406d6db3b1d66d2615e1694db79

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	spaysdatarbx	all (affected)	—
unknown	azure-eventhub-checkpointstoretable	all (affected), * (affected), all (affected), * (affected)	—
unknown	sonic-platform-common	all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected)	—
unknown	allergan	all (affected)	—
unknown	cloud-datasets	* (affected), all (affected), all (affected), * (affected)	—