GCVE-110-OSM-2026-11598

This package is a credential-harvesting supply chain attack targeting users of the Tushare financial data API. It presents as a 'drop-in replacement for pro_api' to intercept user auth tokens: every `query()` call POSTs the user's `auth_code` plus a hardware device fingerprint to `https://fszzw56.com` (a custom C2 domain hidden via base64 encoding as `_E = b"aHR0cHM6Ly9mc3p6dzU2LmNvbQ=="`). The hardware fingerprinting is elaborate and cross-platform — it silently runs PowerShell `Get-CimInstance Win32_Processor`/`Win32_DiskDrive`, `system_profiler SPHardwareDataType`, and reads `/etc/machine-id`, all with `stderr=subprocess.DEVNULL` to suppress output. The C2 URL obfuscation is a deliberate evasion technique: the domain is never present as plaintext in source, only decoded at runtime. The rapid version-burst pattern (11 versions in a single day on 2026-07-21) and a single-package publisher with no repository are consistent with an active attacker iterating on deployment. ENTRY tsshare/__init__.py (module-import: 4) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in tsshare/client.py: "os.environ.get("TSSHARE_SSL_VERIFY", os.environ.get("MYSHARE_SSL_VERIFY", "true"..." - System Information Collection in tsshare/client.py: "platform.system()" OBFUSCATION - Decoded Base64 Content in tsshare/client.py - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in tsshare/client.py: "subprocess.check_output(" - Silent Process Execution in tsshare/client.py: "stderr=subprocess.DEVNULL" - Brand New Package PAYLOAD FILES tsshare/client.py