GCVE-110-OSM-2026-10764

The package contains a hidden backdoor. The promised functionality is an HTTP request library with some additional functions. On every usage, code secretly checks for the presence of specific fields in the response, and if they are found, their content is secretly executed. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-reqcrypt Reasons (based on the campaign): - backdoor Judge assessment: This is a concealed backdoor in a purported HTTP client: the entrypoint `reqcrypts/__init__.py` defines `PayloadManager.process()` to inspect every response for a magic `_payload` field, base64-decode it, and `exec(decoded)` it silently. It also supports attacker-supplied `default_payload` and trigger-based `exec(payload_code)`, which is consistent with remote code execution on package use, not normal library behavior. The attacker model is a supply-chain backdoor operator trying to hijack downstream applications at runtime while suppressing logs via `logger.disabled = True` and the Russian comment about disabling logging. The OSV advisory `MAL-2026-14341` matches the actual code, and the combination of dynamic execution plus hidden payload processing is decisive. ENTRY reqcrypts/__init__.py (module-import: 214) EXFIL - Data Encoding for Exfiltration in reqcrypts/__init__.py: "base64.b64encode(" ADDITIONAL FINDINGS - Dynamic Code Execution in reqcrypts/__init__.py: "exec(decoded)" PAYLOAD FILES reqcrypts/__init__.py