GCVE-110-OSM-2026-10688

During import, package exfiltrates the sensitive file with the Telegram session token. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-deepface-weights Reasons (based on the campaign): - files-exfiltration - target:telegram Judge assessment: This package is a credential stealer that launches on module import and attempts to exfiltrate a Telegram session file, which is exactly the attacker model for an infostealer campaign. In `deepface_weight/__init__.py`, the top-level thread calls `_background_stealer()` and reads `data/telethon_market_userbot.session`, then posts it with `requests.post(..., files=files)` to a plaintext `webhook.site` URL. The Cyrillic comment `# Адрес сервера злоумышленника` explicitly labels the endpoint as the attacker’s server, and the OSV advisory `MAL-2026-14158` corroborates the same Telegram-targeted exfiltration. ENTRY deepface_weight/__init__.py (module-import: 22) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in deepface_weight/__init__.py: "webhook.site" - Python File Upload to Remote in deepface_weight/__init__.py: "requests.post(evil_server_url, files=" - Network Request in deepface_weight/__init__.py: "requests.post(" PAYLOAD FILES deepface_weight/__init__.py