GCVE-110-OSM-2026-13745

The package 'fromthehotel-lyrics' presents as a lyrics client but contains a network call in its main module to 'login.fromthehotel.com', which the IOC classifier identified as a C2 endpoint recovered in plaintext. The data-encoding finding ('json.dumps(data, ensure_ascii=False).encode') in the same file is consistent with serializing collected data prior to exfiltration to that endpoint — a classic collect-serialize-exfil pattern. The domain 'login.fromthehotel.com' uses a 'login.' subdomain on what appears to be an attacker-registered domain, not a legitimate lyrics service infrastructure. Metadata signals (brand-new, single version, no repository) are consistent with a purpose-built exfiltration package. The attacker model is credential or environment data harvesting disguised as a lyrics API client. DESTINATION - 1 c2 (domains) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in src/fromthehotel_lyrics/__init__.py: "json.dumps(data, ensure_ascii=False).encode" ADDITIONAL FINDINGS - Brand New Package PAYLOAD FILES src/fromthehotel_lyrics/__init__.py