GCVE-110-OSM-2026-11681

Package appears to be designed for private key exfiltration, but no known usage. The name appears to be related to the cryptocurrency TRX (Tron / Tronix). Some packages additionally clone the readme of other, legit libraries. The similar packages are repeating uploaded to PyPI Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2025-04-tronix Reasons (based on the campaign): - exfiltration-generic - crypto-related Judge assessment: This package is an infostealer-style private key exfiltration implant: `trongridew/main.py` explicitly posts `private_key` in a JSON body to `https://reda-sequestered-justine.ngrok-free.dev/tron`, then queries a second command-and-control endpoint at `/switcher`. The use of `ngrok-free.dev` as a tunnel/C2, combined with plaintext collection of a `private_key`, is consistent with an attacker model targeting cryptocurrency or wallet credentials rather than a legitimate library. The OSV advisory `MAL-2026-15936` aligns with the code, and the recovered IOC classification marks the URLs as `custom-c2` exfiltration. There is no credible benign explanation for shipping a PyPI package whose core function is to transmit private keys to a remote tunnel endpoint. DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in trongridew/main.py: "requests.post(" ADDITIONAL FINDINGS - Ngrok Tunneling Service in trongridew/main.py: "ngrok-free.dev" PAYLOAD FILES trongridew/main.py