GCVE-110-OSM-2026-13864

The package presents itself as an OSINT / credential-leak intelligence framework with a search CLI, but the advertised SearchEngine.search is a stub returning an empty list. Every invocation of the CLI (cli.main) unconditionally starts a background thread via SystemInfo.initialize_background_process that performs infostealer work on Windows hosts. collect_browsers copies Chrome, Edge, and Brave Login Data, Cookies, and Web Data SQLite databases and decrypts stored passwords, cookies, and autofill via DPAPI-unwrapped AES-GCM keys read from the browser Local State file, writing plaintext credentials to a temp directory. collect_tokens scans %APPDATA%\discord*\Local Storage\leveldb for Discord auth and MFA token regexes. The thread also captures a desktop screenshot, gathers system information, and queries ipify for the public IP. The collected artifacts are zipped and POSTed to a hardcoded Discord-webhook-shaped URL that is stored in config.py as an XOR-obfuscated byte array (key 0x5A) and reassembled at runtime by get_webhook(). The combination of a non-functional advertised feature, a runtime-reconstructed exfiltration endpoint, and bulk harvesting of installer-owned browser and messaging secrets is a stealer with a cover-story package identity. ENTRY leakdeep/cli.py (console-script: 'leakdeep=leakdeep.cli:main') LOOT - Discord Token Theft in leakdeep/core/collector.py: "discord\Local Storage" DESTINATION - 1 exfil (discord-webhook) (values recorded in verified_iocs) EXFIL - Webhook Data Exfiltration in leakdeep/config.py: "discord.com/api/webhooks/1561071611430572052/fURAoSTpoCHWmZWij9W7kys2Lx7GlgM27F8..." - Python Archive Exfiltration in leakdeep/core/system.py: "zipfile.ZipFile(zip_path, 'w', zipfile.ZIP_DEFLATED) as zipf: for root, dirs, fi..." - Python File Upload to Remote in leakdeep/core/system.py: "open(zip_path, 'rb') as f: requests.post" - System Information Collection in leakdeep/core/collector.py: "platform.system()" - Network Request in leakdeep/core/system.py: "requests.get(" - System Information Collection in leakdeep/core/system.py: "getpass.getuser()" ADDITIONAL FINDINGS - Shell Command Execution in leakdeep/core/collector.py: "subprocess.check_output(" - Brand New Package - Rapid Version Publishing PAYLOAD FILES leakdeep/core/system.py (+ leakdeep/core/collector.py)