GCVE-110-OSM-2026-13497

The package contains obfuscated code to exfiltrate data from the environment, targeting primarily Snowflake databases and credentials to them. Some tracks suggest it may be part of a pentest. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-friendly-greeting-tools Reasons (based on the campaign): - exfiltration-generic - obfuscation ENTRY src/friendly_greeting/main.py (console-script: friendly-greeting=friendly_greeting.main:main) EXFIL - Data Encoding for Exfiltration in tools/pack_payload.py: "base64.b64encode(" OBFUSCATION - Python Exec with Encoded Content in src/friendly_greeting/main.py: "exec(gzip.decompress" - Base64 Encoded Payload in src/friendly_greeting/main.py: ""H4sIAAAAAAAC/51TUW+bMBB+51dYvECkLqhKF01USPMSp0EjmBnTrKoqhJizoKQ4s83Satp/nw1ZSNb..." - Deobfuscation Failed in src/friendly_greeting/main.py PAYLOAD FILES tools/pack_payload.py (+ src/friendly_greeting/main.py)