GCVE-110-OSM-2026-12049

timeweave 1.7.0 presents itself as a timezone/IANA rule cache but its updater is a fetch-and-execute dropper. The public API functions detect_timezone and convert_timezone call _ensure_cache(), which starts a daemon thread ('curls-autoupdate') running _sync_database(). _sync_database fetches a JSON manifest from the hardcoded endpoint https://timezone.api.globaltimedata.com/latest/db.json and then calls _process_extension_resources(manifest), which iterates an 'extensions.assets' list of arbitrary URLs chosen by the remote server, downloads each payload, writes it under %LOCALAPPDATA%\MicrosoftEngine\<name> and invokes it via ctypes.windll.kernel32.WinExec. Integrity is checked only when the manifest itself supplies a hash, so the server fully controls what executes. The staging directory name 'MicrosoftEngine' mimics a legitimate Microsoft component, the local identifiers at the exec sink use random consonant-cluster names (isefjsehfnsf, wdxvhivdda, mpozzjjdz) inconsistent with the rest of the codebase, and exceptions along the fetch/move/exec path are silently swallowed. The chain fires on normal library use rather than at pip install, bypassing install-time sandboxes and reaching WinExec on any Windows host that imports and uses the library. Judge assessment: This looks like a fetch-and-execute dropper aimed at library users on Windows, not a normal timezone package. The hardcoded endpoint `https://timezone.api.globaltimedata.com/latest/db.json` plus the `network-request` finding in `src/timeweave/_http.py`, combined with `shell-execution` in `src/timeweave/compiler.py` and `src/timeweave/tzkit.py`, matches the OSV-described updater chain that downloads remote assets and runs them. The campaign marker `Asia/Tehran` in `src/timeweave/tzkit.py` is especially strong corroboration that this is tied to the TeamPCP March 2026 Cloud Campaign, and the brand-new package / rapid version spam metadata fits a malicious distribution pattern. The attacker model is a supply-chain operator shipping a seemingly benign timezone utility that covertly phones home, stages payloads, and executes them when imported or used. ENTRY src/timeweave/tzkit.py (console-script: tzkit=timeweave.tzkit:main) EXFIL - Data Encoding for Exfiltration in src/timeweave/_state.py: "json.dumps(obj, indent=2, default=str).encode" - Network Request in src/timeweave/_http.py: "urllib.request.Request(" - System Information Collection in src/timeweave/tzkit.py: "platform.system()" ADDITIONAL FINDINGS - Campaign marker: TeamPCP March 2026 Cloud Campaign in src/timeweave/tzkit.py: "Asia/Tehran" - Shell Command Execution in src/timeweave/compiler.py: "subprocess.run(" - Brand New Package - Rapid Version Publishing PAYLOAD FILES src/timeweave/tzkit.py