GCVE-110-OSM-2026-11573

This package delivers a 33 MB executable to the victim's machine under the guise of a Python utility; the Python code itself contains no functionality at all. It does not execute anything during installation. The package declares a vermillion console-script entry point pointing at vermillion.bot:main, but no bot.py module exists, only bot.exe. So, the installed command is broken and the binary must be launched by the user or by a follow-up step. bot.exe is a Discord RAT and DDoS tool named Discord_DARK The package's declared dependencies (discord, discord_webhook) and OS-based classifier are consistent with Discord-based command-and-control, but that is inference from packaging, not from the binary.