GCVE-110-OSM-2026-10267

This package is a credential-stealing loader disguised as a bootstrap helper: on import, `euler_sdk/__init__.py` immediately collects host identity, env vars, and sensitive files like `~/.ssh/id_rsa`, `~/.aws/credentials`, `.gitconfig`, and `.env` variants, then POSTs the data to a `webhook.site` endpoint. The attacker model is straightforward supply-chain exfiltration by a malicious package publisher harvesting developer secrets and infrastructure tokens from machines that install it. The plaintext custom-C2 URL and top-level `report()` call make the exfiltration intentional and unconditional, not an incidental telemetry feature. The static score’s `data-theft` and `credential-theft` combos are fully corroborated by the file contents and IOCs. ENTRY euler_sdk/__init__.py (module-import: 68) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Sensitive File Access in euler_sdk/__init__.py: "'.ssh/id_rsa'" - OAST/Interactsh Exfiltration in euler_sdk/__init__.py: "webhook.site" - Python File Upload to Remote in euler_sdk/__init__.py: "urllib.request.Request( 'https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b..." - Git Configuration Access in euler_sdk/__init__.py: ".gitconfig" - Network Request in euler_sdk/__init__.py: "Request( 'https:" - System Information Collection in euler_sdk/__init__.py: "socket.gethostname()" PAYLOAD FILES euler_sdk/__init__.py