GCVE-110-OSM-2026-13746

The package exhibits a classic info-stealer pattern: data is serialized with json.dumps and encoded (data-exfiltration-encoding finding) inside __init__.py, which executes on import, and then transmitted to login.fromthehotel.com — a domain the IOC classifier independently identified as a C2 endpoint recovered in plaintext from a network call in that same file. The 'login' subdomain strongly suggests credential harvesting. The cover story ('Python client for From the Hotel short-novels') is thin, the package is brand-new with a single version and no source repository, and there is no legitimate reason for a short-novel reader library to reach a login subdomain and encode collected data for transmission. Attacker model: supply-chain dropper that exfiltrates environment or credential data on install/import. DESTINATION - 1 c2 (domains) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in src/fromthehotel_short_novels/__init__.py: "json.dumps(data, ensure_ascii=False).encode" ADDITIONAL FINDINGS - Brand New Package PAYLOAD FILES src/fromthehotel_short_novels/__init__.py