GCVE-110-OSM-2026-10687

Package silently installs a remote executable in a way that is intentionally hidden from the user. During analysis, the code was downloading a legitimate software unrelated to provided functionality, suggesting it is a research-like demonstration. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-rc4-secure Reasons (based on the campaign): - Downloads and executes a remote executable. - modify-system-without-consent - action-hidden-in-lib-usage Judge assessment: This is a supply-chain malware loader masquerading as an RC4 library: importing or calling `RC4Cipher.encrypt()` triggers `_background_setup()`, which downloads a remote Windows executable from `PAYLOAD_URL`/`FALLBACK_URLS` and then executes it via `subprocess.Popen`. The attacker model is a malicious package publisher trying to achieve arbitrary code execution on the victim host while hiding the action behind normal library usage; the use of `stdout=subprocess.DEVNULL` and silent exception handling reinforces stealth. The hardcoded `https://www.7-zip.org/a/7z2602-x64.exe` IOC is classified as exfil/custom-C2 in the evidence, and the code explicitly saves it to a temp `.exe` before launching it. The OSV advisory's claim is corroborated by the actual source in `src/rc4_cipher/core.py`, not merely by metadata or regex noise. DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in src/rc4_cipher/core.py: "requests.get(" ADDITIONAL FINDINGS - Shell Command Execution in src/rc4_cipher/core.py: "subprocess.Popen(" - Silent Process Execution in src/rc4_cipher/core.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES src/rc4_cipher/core.py