VDB
GCVE-110-OSM-2026-13076
GCVE-110-OSM-2026-13076
Advisory PublishedCVSS 5.4/10
Malicious PyPI infostealer that collects Chrome extension data and Telegram Desktop session data, then exfiltrates the archives to an operator-controlled Telegram bot.
Static analysis of shortneer 0.1.0 confirms two exfiltration paths. src/data.rs recursively archives Chrome Local Extension Settings on Windows, Linux, and macOS and uploads the in-memory archive as fghj.zip via Telegram sendDocument to chat ID 8756334228. src/telegram.rs recursively archives Telegram Desktop tdata, excluding .wrangler, .git, node_modules, user_data, temp, thumbnails, and emoji, then uploads fghjj5.zip to the same chat. The embedded bot tokens are XOR-obfuscated with key 0xAA and are represented in verified_iocs as decoded Telegram API endpoints. No downloader, secondary payload URL, embedded executable, response-to-code path, persistence, subprocess launcher, or blockchain activity was found. Failures are suppressed by the Python wrapper.
Weaknesses (CWE)
CWE-506Embedded Malicious Code
Risk Scores
CVSS 3.1
5.4/10
Medium · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected Products
| Vendor | Product | Versions | Platforms |
|---|---|---|---|
| unknown | shortneer | all (affected) | — |
Aliases
Browse GCVE Records
3,164 records in the GCVE database · Updated October 4, 2026
No matching records found.
Explore Further
Investigate this vulnerability in the interactive console or download the raw GCVE record.