GCVE-110-OSM-2026-12876

During initialization of the CLI, the package exfiltrates sensitive files. Prior version 0.1.2 the code was launching a calculator as PoC instead of exfiltrating data. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-gcphelpit Reasons (based on the campaign): - files-exfiltration Judge assessment: This package matches a plausible infostealer attacker model: the OSV advisory says initialization exfiltrates sensitive files, and the code-level signals include shell execution in `gcphelpit/_verify.py` via `subprocess.Popen(` plus environment/system fingerprinting with `platform.system()`. Even though the static payload here does not expose the full exfil path, the combination of a CLI wrapper, shell execution, and anti-analysis-style host collection is consistent with a loader that prepares or launches theft of local data. The package is also a newly published one-off by `randicloud`, which fits a disposable malware publisher profile rather than a mature utility author. EXFIL - System Information Collection in gcphelpit/_verify.py: "platform.system()" ADDITIONAL FINDINGS - Shell Command Execution in gcphelpit/_verify.py: "subprocess.Popen(" PAYLOAD FILES gcphelpit/_verify.py