GCVE-110-OSM-2026-3145

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published April 24, 2026

Malicious package detected. Behaviors: data exfiltration. Payload: iploop/sites/blocked_fallbacks.py Secondary files: PKG-INFO, iploop/render_proxy.py Key findings: - Discord Token Theft in PKG-INFO: "dQw4w9WgXcQ" - Startup Persistence in PKG-INFO: ".profile" - Data Encoding for Exfiltration in iploop/render_proxy.py: "base64.b64encode(" - Data Encoding for Exfiltration in iploop/sites/blocked_fallbacks.py: "urllib.parse.quote(" - Dynamic C2 Endpoint Construction in iploop/sites/blocked_fallbacks.py: ""www.") return FALLBACKS.get(domain) def execute_fallback(domain, url, cli..." IOCs: - ipv4: 121.0.0.0, 122.0.0.0, 123.0.0.0, 124.0.0.0, 125.0.0.0 (+3 more) - urls: https://iploop.io, https://docs.iploop.io, https://site.com/page1, https://site.com/page2, https://tough-site.com (+34 more) - domains: iploop.io, docs.iploop.io, site.com, site1.com, site2.com (+37 more) - emails: partners@iploop.io - payloadFileHash: 601bd7a39c16c77f9919597b1a6ad0121be7f5818c3c80e0b84a33dd2797c79a

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	iploop-sdk	1.8.0 (affected)	—

References

Malicious pypi package: iploop-sdk

advisory

vendor

Browse GCVE Records

73,738 records in the GCVE database · Updated July 19, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON