GCVE-110-OSM-2026-12855

During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-donutautosellsrc Reasons (based on the campaign): - infostealer - Downloads and executes a remote executable. - obfuscation - malware - native-extension - steganography - c2-in-blockchain - The package contains code to detect if it is running in a sandbox environment. ENTRY aseity/cli.py (console-script: aseity=aseity.cli:main) OBFUSCATION - Base64 Encoded Payload in aseity/_shimdata.py: "'eJyVVm1z2jgQ/s6v0OmTmYIDJM2RzHEzlLhtJmmSC2mvvZBhhL0GNbbkSjLg3t1/v5VfAJf0mmoGrJV..." ADDITIONAL FINDINGS - Dynamic Code Execution in aseity/compat.py: "compile(code, "<aseity-compat>", "exec")" PAYLOAD FILES aseity/compat.py