GCVE-110-OSM-2026-3719

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published May 7, 2026

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution. [osmalyze-auto] Entrypoint: mapping/encoder.py (console-script: "mapping-encode=mapping.encoder:main") Payload: mapping/encoder.py Secondary files: mapping/__init__.py Key findings: - Suspicious TLD Domain in mapping/__init__.py: "https://mapping-worker.email" - Dynamic Code Execution in mapping/encoder.py: "exec(decoded_string)" - Suspicious TLD Domain in mapping/encoder.py: "https://mapping-worker.email" - Shell Command Execution in mapping/manager.py: "subprocess.run(" - Rapid Version Publishing IOCs: - sha256Hashes: 3834dcbc09e5bbdab4f47c10e0fd7c201df6d5efee46b6759331cbf594b4f590 - payloadFileHash: 09e1d4b8e3427ba2a1656fc54cd598ec367ce6f3678339ef0fc92582bbf794dc

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	mapping-encrypt	0.2.1 (affected)	—

References

Malicious pypi package: mapping-encrypt

advisory

vendor

Browse GCVE Records

74,352 records in the GCVE database · Updated July 22, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON