GCVE-110-OSM-2026-11597

Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX (Tron / Tronix). Some packages additionally clone the readme of other, legit libraries. The similar packages are repeating uploaded to PyPI Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-04-tronix Reasons (based on the campaign): - exfiltration-generic - crypto-related Judge assessment: This package is consistent with a private-key exfiltration loader run by a commodity crypto-theft actor targeting Tron/TRX holders. The code in `trongridi/main.py` posts a `private_key` field to `https://reda-sequestered-justine.ngrok-free.dev/tron` and then queries `/switcher`, which is a clear custom C2/exfil pattern rather than a legitimate library behavior. The use of an `ngrok-free.dev` tunnel, combined with the OSV MAL-2026-15858 advisory and the package's minimal throwaway metadata, strongly supports malicious intent. The attacker model is straightforward: steal wallet secrets and phone home to a control endpoint. DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in trongridi/main.py: "requests.post(" ADDITIONAL FINDINGS - Ngrok Tunneling Service in trongridi/main.py: "ngrok-free.dev" PAYLOAD FILES trongridi/main.py