GCVE-110-OSM-2026-10778

This package has a burner-like metadata profile, with no description, no repository, and only minimal package fields, which is often seen in throwaway or staged uploads. The only concrete network indicator is a passive RPC endpoint, `https://eth.llamarpc.com`, and the recovered Ethereum addresses are not by themselves proof of theft or exfiltration. However, the presence of multiple `ethereumAddresses` marked as `exfil` and a zero address alongside minimal metadata is consistent with a crypto-drainer or wallet-related malicious workflow, even though the code body is not shown here. I would treat this as suspicious pending code review rather than confirmed malicious because the attacker model is plausible but not directly demonstrated in the available evidence. DESTINATION - 3 exfil (ethereumAddresses) (values recorded in verified_iocs)