GCVE-110-OSM-2026-10268

This is credential-and-environment theft by a third-party package acting as a dropper for exfiltration to a custom C2. The import-time code in morpho_sdk/__init__.py collects SSH keys, AWS credentials, .gitconfig, .npmrc, .env files, browser-adjacent secrets, and host/user/platform data, then POSTs the JSON to a webhook.site endpoint. The attacker model is clear: steal developer secrets from machines that install or import the package, with module-import execution ensuring the payload runs immediately. The minimal metadata and throwaway shape reinforce that this is not a legitimate telemetry library. ENTRY morpho_sdk/__init__.py (module-import: 68) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Sensitive File Access in morpho_sdk/__init__.py: "'.ssh/id_rsa'" - OAST/Interactsh Exfiltration in morpho_sdk/__init__.py: "webhook.site" - Python File Upload to Remote in morpho_sdk/__init__.py: "urllib.request.Request( 'https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b..." - Git Configuration Access in morpho_sdk/__init__.py: ".gitconfig" - Network Request in morpho_sdk/__init__.py: "Request( 'https:" - System Information Collection in morpho_sdk/__init__.py: "socket.gethostname()" PAYLOAD FILES morpho_sdk/__init__.py