GCVE-110-OSM-2026-12869

Malicious package detected. Behaviors: data exfiltration, code execution. PERSISTENCE - Startup Persistence in src/braxton/shellf/setup.py: ".zshrc" DESTINATION - 4 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in src/braxton/cloud/local.py: "encodeURIComponent(currentCloudPath" - Data Encoding for Exfiltration in src/braxton/crypto/encoder.py: "base64.b64encode(" - System Information Collection in src/braxton/animation/collection.py: "platform.system()" - System Information Collection in src/braxton/cloud/local.py: "socket.gethostname()" - DNS Lookup in src/braxton/cloud/local.py: "socket.gethostbyname(" - Network Request in src/braxton/get/api.py: "requests.get(" - System Information Collection in src/braxton/shellf/setup.py: "platform.system()" - System Information Collection in src/braxton/sub_exe/execute.py: "platform.system()" (+2 more) ADDITIONAL FINDINGS - Shell Command Execution in src/braxton/GitHub/clone_repo.py: "subprocess.run(" - Brand New Package PAYLOAD FILES src/braxton/cloud/local.py (+ src/braxton/user/info.py)