GCVE-110-OSM-2026-3155

Advisory PublishedCVSS 9.6/10

Vulnetix · Advisory published April 25, 2026

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. Payload: phantom/phantom/tools/payload_gen/payload_gen_actions.py Secondary files: phantom/tools/payload_gen/payload_gen_actions.py, phantom/config/secrets.py Key findings: - Sensitive File Access in phantom/checkpoint/checkpoint.py: ""/etc/passwd"" - Sensitive File Access in phantom/phantom/checkpoint/checkpoint.py: ""/etc/passwd"" - Sensitive File Access in phantom/phantom/tools/fuzzer/fuzzer_manager.py: ""/etc/passwd"" - OAST/Interactsh Exfiltration in phantom/phantom/tools/oast/oast_manager.py: "interact.sh" - Base64 Decoded Eval in phantom/phantom/tools/payload_gen/payload_gen_actions.py: "eval(atob(" IOCs: - urls: https://app.com, https://caido.io, https://docs.oasis-open.org/sarif/sarif/v2.1.0/sarif-v2.1.0.html, https://{target, https://host/org/repo (+24 more) - domains: estin.dz, app.com, caido.io, events.Click, oast.pro (+11 more) - emails: r_gadouri@estin.dz - payloadFileHash: 9032367301581693ffcfb6b257eaa1a35536f257e86f6ab618439c22c8c77d4e

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

9.6/10

Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	phantom-agent	0.9.206 (affected)	—

References

Malicious pypi package: phantom-agent

advisory

vendor

Browse GCVE Records

73,161 records in the GCVE database · Updated July 16, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON