GCVE-110-OSM-2026-10639

APT malware detected: chai-max. Associated with threat actor(s): DPRK/Lazarus. Behaviors: data exfiltration, network activity. DESTINATION - custom-c2: http://46.225.21.180:3000/api/narrative-accounts (primary, plaintext) in solana_wallet_utils.py - custom-c2: https://api.mainnet-beta.solana.com (plaintext) in solana_wallet_utils.py - custom-c2: api.mainnet-beta.solana.com (plaintext) in solana_wallet_utils.py - custom-c2: 46.225.21.180 (plaintext) in solana_wallet_utils.py EXFIL - Network Request in solana_wallet_utils.py: "requests.post(" - Suspicious Domain in solana_wallet_utils.py: "http://46.225.21.180" ADDITIONAL FINDINGS - Chai-Max Wallet Theft Indicators in PKG-INFO: "solana-wallet" PAYLOAD FILES PKG-INFO (+ setup.py, solana_wallet_utils.py) INDICATORS (IOCs) - payloadFileHash: fa0cb6b405063c2dc3aec801acd04d4f858b9b822ed6f2eb35c3b5348d3d654f