VDB
GCVE-110-OSM-2026-131
GCVE-110-OSM-2026-131
Advisory PublishedCVSS 9.6/10
Malicious package detected. Behaviors: data exfiltration.
Entrypoint: silly_logger/__init__.py (module-import: 124)
Exfil: https://discord.com/api/webhooks/1505720221963653312/A9NH4y2b69lag2dI-Nc4h7gKo1BnQ4_Y1nG-vnGbMjuCrnnkYWKqmwedreutonCUdnZm (discord-webhook, recovery: plaintext in silly_logger/__init__.py)
Payload: silly_logger/__init__.py
Key findings:
- Webhook Data Exfiltration in silly_logger/__init__.py: "discord.com/api/webhooks/1505720221963653312/A9NH4y2b69lag2dI-Nc4h7gKo1BnQ4_Y1nG..."
- Brand New Package
IOCs:
- discordWebhooks: https://discord.com/api/webhooks/1505720221963653312/A9NH4y2b69lag2dI-Nc4h7gKo1BnQ4_Y1nG-vnGbMjuCrnnkYWKqmwedreutonCUdnZm
- payloadFileHash: 7da6c2e38cdc907b0f5821055af9ff57074fd8ca12aaee87a96e3d825469b0d2
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | nfd | all (affected), all (affected), all (affected), all (affected) | — |
| unknown | thief-utils | all (affected), all (affected), all (affected), * (affected) | — |
| unknown | server-fpti | all (affected) | — |
| unknown | silly-logger | 0.1.7 (affected) | — |
| unknown | my-super-lib | all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), * (affected) | — |
References
Malicious pypi package: my-super-lib
advisory
Malicious pypi package: nfd
advisory
Malicious pypi package: thief-utils
advisory
Malicious npm package: server-fpti
advisory
Malicious pypi package: silly-logger
advisory
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.