GCVE-110-OSM-2026-10873

This is a hidden backdoor in a PyPI package posing as a request helper: the import-time entrypoint in `requests_crypt/__init__.py` creates a default handler and the `DataProcessor.process()` path base64-decodes response content and immediately `exec(decoded)` when a chosen field is present. The code also allows arbitrary stored `processor_code` to be executed with `exec(processor_code)`, which is consistent with remote code execution triggered through normal library usage, not a legitimate library pattern. The attacker model is a supply-chain implant author who wants to hijack applications that import or use `requests-crypt` so that malicious payloads can be smuggled through HTTP responses and executed on the victim host. ENTRY requests_crypt/__init__.py (module-import: 211) EXFIL - Data Encoding for Exfiltration in requests_crypt/__init__.py: "base64.b64encode(" ADDITIONAL FINDINGS - Dynamic Code Execution in requests_crypt/__init__.py: "exec(decoded)" PAYLOAD FILES requests_crypt/__init__.py