GCVE-110-OSM-2026-11662

The provided functionality hides code that exfiltrates files to a remote location. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-asti Reasons (based on the campaign): - files-exfiltration - action-hidden-in-lib-usage - target:android Judge assessment: This package looks more like a proxy-listing utility than an infostealer: the visible code in `asti/starts.py` generates and validates proxy metadata, and the prominent `base64.b64encode` call is used for ordinary encoding in `encrypt_data()` and `generate_key()`, not proven exfiltration. However, the package also carries a plaintext Telegram bot token (`1263262891:neVZzZ8aKyH25k8BADzDkkurSehW3NuWgrg`) and multiple hardcoded network endpoints under `api.proxyscrape.com`, `proxy-list.download`, and `tapi.bale.ai`, which is highly unusual for a normal library. The OSV MAL advisory claims hidden file exfiltration and Android targeting, but the provided evidence here does not corroborate that behavior in the visible source, so I cannot elevate this to malicious on the current slice. Treat this as suspicious infrastructure with unclear attacker model, likely a burner package or misrepresented proxy scraper that warrants manual review. DESTINATION - 16 exfil (telegram-bot, custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in asti/starts.py: "base64.b64encode(" PAYLOAD FILES asti/starts.py