GCVE-110-OSM-2026-13747

The package contains a network call to `login.fromthehotel.com` inside `src/fromthehotel_songs/__init__.py`, meaning the call executes on import — a common pattern for stealers and exfiltration implants. The IOC classifier assigned this domain a C2 role, and the `data-exfiltration-encoding` finding shows `json.dumps(data, ensure_ascii=False).encode` in the same file, suggesting data is being collected, serialized, and transmitted. The package is brand-new (17 hours old), has no linked source repository, and has exactly one version — metadata consistent with a throwaway exfiltration package rather than a legitimate library. The attacker model is a credential or environment stealer that runs silently on import and POSTs collected data to an attacker-controlled login endpoint, though the absence of the actual code content prevents full confirmation. DESTINATION - 1 c2 (domains) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in src/fromthehotel_songs/__init__.py: "json.dumps(data, ensure_ascii=False).encode" ADDITIONAL FINDINGS - Brand New Package PAYLOAD FILES src/fromthehotel_songs/__init__.py