GCVE-110-OSM-2026-6752

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published June 27, 2026

Malicious package detected. Behaviors: data exfiltration. DESTINATION - urls: https://vibe-rewards.xyz (c2, plaintext) - domains: vibe-rewards.xyz (c2, plaintext) EXFIL - Python File Upload to Remote in vibe_rewards.py: "urllib.request.Request(f"{_api_url}/api/v1/metrics", data=" - Data Encoding for Exfiltration in vibe_rewards.py: "urllib.parse.quote(" - Python Background Thread Execution in vibe_rewards.py: "threading.Thread(target=_track_impression, args=(ad.get('ad_id'), imp_id), daemo..." - Network Request in vibe_rewards.py: "urllib.request.Request(" ADDITIONAL FINDINGS - Suspicious TLD Domain in vibe_rewards.py: "https://vibe-rewards.xyz" - Brand New Package - Rapid Version Publishing PAYLOAD FILES vibe_rewards.py INDICATORS (IOCs) - payloadFileHash: c600f37d9a5d9ea168d30f5fbb967613b4c6e051badc836755023d0e807e25b1

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	vibe-rewards	all (affected)	—

References

Malicious pypi package: vibe-rewards

advisory

vendor

Browse GCVE Records

73,280 records in the GCVE database · Updated July 17, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON