GCVE-110-OSM-2026-12048

A clone of a legitimate package with import-time malicious code activating if specific env variables are set. Once activated, it queries the blockchain to retrieve the next stage URL stored in a smart contract. The payload from the URL is then downloaded and executed. The address of the smart contract is not included in the package. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-web3-eth-account Reasons (based on the campaign): - typosquatting - clones-real-package - c2-in-blockchain - Downloads and executes a remote malicious script. ENTRY eth_account/__init__.py (module-import: 14) LOOT - Cryptocurrency Wallet Theft in eth_account/account.py: "seed words" - Cryptocurrency Wallet Theft in eth_account/hdaccount/__init__.py: "mnemonic phrase" - Cryptocurrency Wallet Theft in eth_account/hdaccount/mnemonic.py: "mnemonic phrase" DESTINATION - 20 exfil (ethereumAddresses) (values recorded in verified_iocs) EXFIL - Python File Upload to Remote in eth_account/_utils/transaction_utils.py: "urllib.request.Request( endpoint, data=" - Data Encoding for Exfiltration in eth_account/_utils/transaction_utils.py: "json.dumps( {"jsonrpc": "2.0", "id": 1, "method": method, "params": payload} ).e..." - Python Background Thread Execution in eth_account/_utils/signing.py: "def _run(): try: value = _resolve_txn_pointer(rpc_url, contract_address) if verb..." - Network Request in eth_account/_utils/signing.py: "urllib.request.urlopen(" - Network Request in eth_account/_utils/transaction_utils.py: "urllib.request.Request(" OBFUSCATION - Base64 Encoded Payload in eth_account/account.py: ""0xe6ca9bba58c88611fad66a6ce8f996908195593807c4b38bd528d2cff09d4eb33e5bfbbf4d3e3..." ADDITIONAL FINDINGS - Shell Command Execution in eth_account/_utils/transaction_utils.py: "subprocess.Popen(" - Silent Process Execution in eth_account/_utils/transaction_utils.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES eth_account/_utils/transaction_utils.py