VDB
GCVE-110-OSM-2026-130
GCVE-110-OSM-2026-130
Advisory PublishedCVSS 9.6/10
Malicious package detected.
Payload: projz/client.py
Key findings:
- Cryptocurrency Wallet Theft in projz/client.py: "recovery phrase"
IOCs:
- urls: https://api.projz.com, https://www.projz.com, https://www.projz.com/s/c/{ref
- domains: www.projz.com, projz.com, RichFormat.AttachmentSpan.Data.Link
- sha256Hashes: ce070279278de1b6390b76942c13a0b0aa0fda6aedd6f2d655eda7cf6543b35f
- payloadFileHash: f55581b1df04c25d8143b12c0718f5381f55404d7dbf85f33aeba4fe46d3d081
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | ariadne-federation | all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), all (affected) | — |
| unknown | collecters | all (affected), all (affected), all (affected), all (affected) | — |
| unknown | thief-utils | all (affected), all (affected), all (affected), * (affected) | — |
| unknown | projz-py | 2.4.7 (affected) | — |
| unknown | chai-as-emitted | * (affected) | — |
References
Malicious pypi package: thief-utils
advisory
Malicious pypi package: collecters
advisory
Malicious pypi package: projz-py
advisory
Browse GCVE Records
74,198 records in the GCVE database · Updated July 21, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.