GCVE-110-OSM-2026-10777

The package shows a credential-theft-oriented pattern: `src/neutrl_core/providers.py` reads sensitive material like `.ssh/id_ed25519` and also collects host context via `platform.node()`, which is consistent with preparing machine identity and secrets for exfiltration. The bundled plaintext RPC endpoints (`eth.llamarpc.com`, `rpc.ankr.com`, `arb1.arbitrum.io`) look like normal blockchain infrastructure, but the presence of `https://chainrpc-pool.com/v1/mainnet` and an internal-looking `https://hasura.internal/v1/graphql` raises concern about hidden or environment-specific data flow. Metadata is also extremely sparse (`missing-description`, `no-repository`, `metadata-minimal`), which fits a throwaway or burner package shape. I cannot prove a clear attacker model from the visible code alone, so this is suspicious rather than confirmed malicious, but it warrants manual review. EXFIL - Sensitive File Access in src/neutrl_core/providers.py: "".ssh/id_ed25519"" - System Information Collection in src/neutrl_core/providers.py: "platform.node()" PAYLOAD FILES src/neutrl_core/providers.py