GCVE-110-OSM-2026-13645

This package implements a clear file exfiltration attack targeting Android devices. The function in proxy-rubikis/starts.py walks /storage/emulated/0/ (Android internal storage), collects files with extensions .py, .pyrubi, .json, and .txt, zips them by type, and POSTs each archive to a Telegram bot (token 1318818498:SrxMZcLBO-_7yqmmo36gZE1tO5KsbIVgoKY, chat_id 5263487757) via the Bale messaging API (tapi.bale.ai). The attacker model is straightforward data theft: harvest Python scripts and configuration files from an Android device and exfiltrate them to an attacker-controlled Telegram/Bale bot. The package has no legitimate purpose — it has a meaningless description, no repository, was published within the last hour, and exists in a single version. Variable name obfuscation (single-letter names throughout) confirms deliberate evasion intent. DESTINATION - 1 exfil (telegram-bot) (values recorded in verified_iocs) ADDITIONAL FINDINGS - Brand New Package