GCVE-110-OSM-2026-12877

Malicious code in py-devoli-common (PyPI) Judge assessment: This looks like a dependency-confusion-style throwaway package: the version is artificially inflated to 999.999.999, the metadata is intentionally minimal, and there is no repository or homepage to anchor legitimacy. The OSV malware advisory is a signal worth taking seriously, but the evidence here does not include any code-level exfiltration, install hooks, or obfuscation that would confirm an actual payload. The attacker model is plausible as a namespace squatting / dependency confusion attempt against an internal package named py-devoli-common, but based on the current evidence I cannot prove malicious behavior beyond suspicious publication hygiene.