GCVE-110-OSM-2026-10768

This package appears to be an SEO spam / link-farm package rather than a functional library. The publisher 'dallen' has 34 packages all following the identical pattern: single-version, no repository, AI-tool branding, and a homepage URL as the only real content. The package's __init__.py contains only a website reference (murekav8.org) with no functional code, consistent with a strategy of publishing PyPI packages to boost search engine ranking for external AI tool websites. There is no evidence of malicious code execution, exfiltration, or credential theft — the package is inert. However, this publisher behavior (mass-publishing stub packages pointing to external domains) is policy-violating and potentially abusive of the PyPI ecosystem, warranting flagging even in the absence of malware. ENTRY murekav8/__init__.py (module-import: 4)