GCVE-VVD-OSM-2026-246

Malicious package detected. Behaviors: code execution, obfuscated code. Payload: src/fastapis_requests/api.py Key findings: - Escaped Protocol Pattern in src/fastapis_requests/utils.py: ""://"" - Decoded Base64 Content in src/fastapis_requests/api.py - Shell Command Execution in setup.py: "os.system(" - Shell Command Execution in src/fastapis_requests/api.py: "subprocess.Popen(" - Silent Process Execution in src/fastapis_requests/api.py: "stdout=subprocess.DEVNULL" IOCs: - ipv4: 8.8.8.8 - ipv6: 1::, fe80::, 1200:0000:ab00:1234:0000:2552:7777:1313 - urls: http://www.apache.org/licenses/, https://httpbin.org/basic-auth/user/pass, https://httpbin.org/post, https://httpbin.org/get, https://{url (+48 more) - domains: www.apache.org, httpbin.org, tools.ietf.org, www.ietf.org, MANIFEST.in (+46 more) - emails: me@kennethreitz.com, pass@httpbin.org, pass@complex.url.com, pass%20pass@complex.url.com, pass%23pass@complex.url.com (+4 more) - payloadFileHash: 88029a976e8803b8a552e953e089fb8025b094f204f29fe29475d8aaebbc19fc Decoded/deobfuscated IOCs: - urls: https://cleverstack-ext30341.vercel.app/api/m, https://cleverstack-ext30341.vercel.app/api/l, https://cleverstack-ext30341.vercel.app/api/w - domains: cleverstack-ext30341.vercel.app