GCVE-VVD-OSM-2026-635

Malicious package detected. Behaviors: code execution, network activity, obfuscated code. Payload: fluxhttp/web_app.py Key findings: - Base64 Decoded Eval in fluxhttp/web_app.py: "exec(base64.b64decode" - Remote Code Execution in fluxhttp/web_app.py: "exec(base64.b64decode(data.get(" - Python Exec with Encoded Content in fluxhttp/web_app.py: "exec(base64.b64decode" - Download and Execute in fluxhttp/web_app.py: "urllib.request.urlopen(req, timeout=30) as res: data = json...." - Escaped Protocol Pattern in fluxhttp/web_urldispatcher.py: ""://"" IOCs: - ipv4: 8.8.8.8, 8.8.4.4, 7.2.3.1, 1.2.3.4, 11.11.11.11 (+6 more) - ipv6: fe80::, be::, 1::, 2::, 3:: (+13 more) - urls: https://:password@host``, https://example.com./``., https://llhttp.org, http://127.0.0.1, http://httpbin.org (+45 more) - domains: pip.pypa.io, TestClient.app, client.app, docs.fluxhttp.org, llhttp.org (+45 more) - emails: team@fluxhttp.org, pass@some.proxy.com, xxx@x.co, pass@fluxhttp.io, fedor@indutny.com (+1 more) - sha256Hashes: 5276d46021e0e0d7577e0c9155800cbf62932d60a50783fec42aefb63febedec, d067f01423cddb3c442933b5fcc039b18ab651fcec1bc91c577693aafc25cf78, f9823c608638b8a77fec1c2bd28dc5c043f08c775ec59e7e262dd74b4ebb7384, 56514404ce87a15bfc6b400026d73a270165b2fdbe70313cfa007de29ddd7e14, dab8f933203eeb245d60f856e542a45b888d5a110094620e4811f90f816628d1 (+6 more) - payloadFileHash: f17b8bdac5adf462b9446d57f224a1f484ba5fdcfeb6f3abbfd8a9d109bc7f71