VDB

GCVE-110-OSM-2026-3517

GCVE-110-OSM-2026-3517
Advisory PublishedCVSS 8.8/10
Vulnetix · Advisory published May 4, 2026
[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration. [osmalyze-auto] Payload: puan4/core.py Key findings: - Data Encoding for Exfiltration in puan4/core.py: "base64.b64encode(" IOCs: - ipv4: 185.246.113.53 - urls: https://pip.pypa.io/en/stable/ - domains: pip.pypa.io - payloadFileHash: 9f1cae1f347ba7b9e25c6d4e6e3dee51da7502a8aef4fdd8036f4daec19b7704
Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1
8.8/10
High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

VendorProductVersionsPlatforms
unknownpuan4all (affected)—

Aliases

MAL-2026-3244

References

vendor
Malicious pypi package: puan4
advisory
advisory

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON
$ Console Community · 100/wk Open console ›