GCVE-110-OSM-2026-9073

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published July 24, 2026

Malicious package detected. Behaviors: data exfiltration, code execution. ENTRY vtranalytic/__init__.py (module-import: 17) DESTINATION - telegram-bot: api.telegram.org/bot{token}/sendMessage (primary, plaintext) in vtranalytic/vtranalytic.py - telegram-bot: api.telegram.org/bot{token}/getChat (plaintext) in vtranalytic/vtranalytic.py - telegram-bot: api.telegram.org/bot{token}/forwardMessage (plaintext) in vtranalytic/vtranalytic.py EXFIL - Data Encoding for Exfiltration in vtranalytic/vtranalytic.py: "json.dumps(data).encode" - System Information Collection in vtranalytic/vtranalytic.py: "socket.gethostname()" ADDITIONAL FINDINGS - Shell Command Execution in vtranalytic/vtranalytic.py: "subprocess.run(" - Shell Command Variable Setup in vtranalytic/vtranalytic.py: "Windows": ps_cmd = """ powersh" - Brand New Package - Rapid Version Publishing PAYLOAD FILES vtranalytic/vtranalytic.py INDICATORS (IOCs) - payloadFileHash: 390d5503b9e12d25d4c7d07749c08527ee6adce3ff8487c871a9ba450da120b5

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	vtranalytic	9.0.7 (affected)	—

References

Malicious pypi package: vtranalytic

advisory

vendor

Browse GCVE Records

75,788 records in the GCVE database · Updated August 2, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Open in Console Download JSON