GCVE-110-OSM-2026-11660

The provided functionality hides code that exfiltrates files to a remote location. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-asti Reasons (based on the campaign): - files-exfiltration - action-hidden-in-lib-usage - target:android Judge assessment: This package looks like an Android-targeting exfiltrator masquerading as a proxy utility: `astlsi/starts.py` contains a plaintext Telegram bot token and multiple suspicious endpoints such as `https://tapi.bale.ai/{self.token`, `api.proxyscrape.com`, and `proxy-list.download`, with the analyzer classifying them as exfiltration IOCs. The code also uses `base64.b64encode(` in `SecurityUtils.generate_key` and `encrypt_data`, which matches the `data-exfiltration-encoding` finding and is consistent with hiding payloads before transmission rather than normal library behavior. The OSV advisory’s claim of `files-exfiltration` and `action-hidden-in-lib-usage` is corroborated by the plaintext C2/exfil markers in the source, not contradicted by it. Attacker model: a commodity infostealer or Android malware operator using a benign-looking proxy/helper package to collect and send data to a Telegram bot and remote endpoints. DESTINATION - 16 exfil (telegram-bot, custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in astlsi/starts.py: "base64.b64encode(" PAYLOAD FILES astlsi/starts.py