VDB
GCVE-110-OSM-2026-705
GCVE-110-OSM-2026-705
Advisory PublishedCVSS 9.6/10
Malicious package detected. Behaviors: code execution.
Payload: pyutils_helper/_core.py
Secondary files: pyutils_helper/setup_check.py
Key findings:
- Download Execute Delete Pattern in pyutils_helper/_core.py: "executable
if system != 'Windows':
os.chmod(xmrig_pa..."
- Shell Command Execution in pyutils_helper/_core.py: "subprocess.Popen("
- Silent Process Execution in pyutils_helper/_core.py: "stdout=subprocess.DEVNULL"
- Shell Command Execution in pyutils_helper/setup_check.py: "subprocess.run("
- IP Lookup Service in pyutils_helper/setup_check.py: "ifconfig.me"
IOCs:
- domains: pool.supportxmr.com, proc.info
- moneroAddresses: 44haKQM5F43d37q3k6mV45YbrL5g6wGHWNB5uyt2cDfTdR8d9FicJCbitjm1xeKZzEVULG7MqdVFWEa9wKXsNLTpFvzffR5
- payloadFileHash: 8d1db6f30fd7298971216c77ceec17993de5418fd2cb9ecf4ab83cdc7d385587
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
9.6/10
Critical · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | pyutils-helper | all (affected) | — |
Aliases
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.