GCVE-110-OSM-2026-13503

During import, the package downloads and executes an infostealer. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-fontcase Reasons (based on the campaign): - infostealer - Downloads and executes a remote executable. - uses-telegram-bot - exfiltration-browser-data - exfiltration-credentials ENTRY src/fontcase/cli.py (console-script: fontcase=fontcase.cli:main) EXFIL - System Information Collection in src/fontcase/__init__.py: "platform.system()" ADDITIONAL FINDINGS - Shell Command Execution in src/fontcase/__init__.py: "subprocess.Popen(" - Silent Process Execution in src/fontcase/__init__.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES src/fontcase/__init__.py