GCVE-110-OSM-2026-11571

This package fits a malware dropper/infostealer attacker model: the codebase combines hidden decoded content in src/syswatch/_monitor.py with shell execution, silent process execution, HTTP requests, and environment fingerprinting in diagnostics.py. The presence of a Railway-hosted URL (https://github-repo.up.railway.app) inside decoded base64, plus platform.system() and platform.machine() checks, matches the OSV-described campaign pattern of sandbox evasion and remote payload delivery. Although syswatch.io appears as passive project metadata, the operational evidence points to concealed execution and likely exfiltration rather than a legitimate system-monitoring utility. EXFIL - Network Request in src/syswatch/_network.py: "urllib.request.Request(" - System Information Collection in src/syswatch/diagnostics.py: "platform.system()" OBFUSCATION - Decoded Base64 Content in src/syswatch/_monitor.py (x2) - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in src/syswatch/_process.py: "subprocess.run(" - Silent Process Execution in src/syswatch/_process.py: "stdout=_DEVNULL" PAYLOAD FILES src/syswatch/_monitor.py