GCVE-110-OSM-2026-11419

This looks like a crypto-infostealer whose attacker model is straightforward: capture a victim's private key and send it to an attacker-controlled C2. The entry code in `tronlinker/main.py` builds `{'private_key': private_key}` and posts it to an attacker-controlled ngrok endpoint, then polls `/switcher` on the same ngrok host, which is consistent with command-and-control plus exfiltration. The ngrok-free.dev tunnel, plaintext recovered IOC, and the OSV MAL-2026-15588 advisory all corroborate the same malicious behavior rather than a benign network client. The package’s minimal metadata and throwaway shape further support a burner-style malware upload. DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in tronlinker/main.py: "requests.post(" ADDITIONAL FINDINGS - Ngrok Tunneling Service in tronlinker/main.py: "ngrok-free.dev" PAYLOAD FILES tronlinker/main.py