VDB
GCVE-110-OSM-2026-153
GCVE-110-OSM-2026-153
Advisory PublishedCVSS 8.8/10
Malicious package detected. Behaviors: data exfiltration, code execution.
Entrypoint: hmacsync/__init__.py (module-import: 47)
Payload: hmacsync/_m1.py
Secondary files: hmacsync/_m0.py, hmacsync/_m2.py
Key findings:
- Shell Command Execution in hmacsync/_m1.py: "subprocess.run("
- Shell Command Variable Setup in hmacsync/_m1.py: "windows_sid_powershell() -> str:
try:
cmd = [
"powers..."
- Shell Command Execution in hmacsync/_m5.py: "subprocess.run("
- Silent Process Execution in hmacsync/_m5.py: "stdout=subprocess.DEVNULL"
- Brand New Package
IOCs:
- payloadFileHash: 41a273058d11941cfa9b8276a6ab7d89d49534674466018647d597667c3783a9
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
8.8/10
High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | hmacsync | all (affected) | — |
| unknown | requests-lite | 2.32.7 (affected), 2.32.7 (affected), 2.32.7 (affected), 2.32.7 (affected), 2.32.7 (affected), 2.32.7 (affected), 2.32.7 (affected) | — |
| unknown | demozecosso | all (affected), all (affected), all (affected), all (affected) | — |
| unknown | sidebar-basket | all (affected) | — |
| unknown | demozecox | all (affected), all (affected), * (affected), * (affected) | — |
References
Malicious pypi package: demozecox
advisory
Malicious pypi package: demozecosso
advisory
Malicious pypi package: hmacsync
advisory
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.