GCVE-110-OSM-2026-13494

The package imitates real activity and instead deploys a coin miner. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-voxeval Reasons (based on the campaign): - cryptominer DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Python File Upload to Remote in voxcpmui4/harness.py: "urllib.request.Request(url, data=" - Network Request in voxcpmui4/harness.py: "urllib.request.urlopen(" ADDITIONAL FINDINGS - Shell Command Execution in voxcpmui4/harness.py: "subprocess.Popen(" - Silent Process Execution in voxcpmui4/harness.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES voxcpmui4/harness.py