GCVE-110-OSM-2026-5662

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published June 10, 2026

Malicious package detected. Entrypoint: jfrog_curation_hello_links/__init__.py (module-import: 4) Key findings: - Brand New Package IOCs: - urls: https://files.pythonhosted.org/packages/0c/9e/477bb986bc86e5270fcfe07c6f5503d77151818d64a0841ecfda054221dc/jfrog_curation_malicious_dummy-0.0.1-py3-none-any.whl#egg=jfrog-curation-malicious-dummy-0.0.1 - domains: files.pythonhosted.org

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	jfrog-curation-hello-links	all (affected)	—

References

Malicious pypi package: jfrog-curation-hello-links

advisory

vendor

Browse GCVE Records

74,147 records in the GCVE database · Updated July 21, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON