GCVE-110-OSM-2026-10689

During import, package exfiltrates the sensitive file with the Telegram session token. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-deepface-weights Reasons (based on the campaign): - files-exfiltration - target:telegram Judge assessment: This package is an obvious infostealer targeting a Telegram session token: `deepface_weights/__init__.py` starts a daemon thread on import, waits for `data/telethon_market_userbot.session`, and uploads it with `requests.post(..., files=files)` to a `webhook.site` exfiltration endpoint. The attacker model is credential theft and session hijacking, with the hardcoded `evil_server_url` and the comment `# Адрес сервера злоумышленника` reinforcing malicious intent. The behavior is active at module import, so simply installing or importing the package can trigger theft without user interaction. The OSV advisory `MAL-2026-14132` is fully corroborated by the code and IOCs, not just metadata. ENTRY deepface_weights/__init__.py (module-import: 18) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in deepface_weights/__init__.py: "webhook.site" - Python File Upload to Remote in deepface_weights/__init__.py: "requests.post(evil_server_url, files=" - Python Background Thread Execution in deepface_weights/__init__.py: "def _background_stealer(): target_file = "data/telethon_market_userbot.session" ..." - Network Request in deepface_weights/__init__.py: "requests.post(" PAYLOAD FILES deepface_weights/__init__.py