GCVE-110-OSM-2026-13865

This package does not pull a secondary payload or include an exfil destination, and therefore has no malicious component itself. However, this package appears to have been intended to be run in conjunction with other packages that complete the malicious payload. The package implements a fetch-and-exec pattern in `src/webrunc/__init__.py` where `requests.get(url)` retrieves remote content and `exec()` runs it directly — a canonical dropper/loader attacker model. This is corroborated by `subprocess.run` calls suggesting the executed payload may also spawn shell commands. The publisher email `Leo@pop.rasberrypi` uses a non-existent TLD and misspelled domain. EXFIL - Fetch and Eval/Exec in src/webrunc/__init__.py: "requests.get(url) if wm: print("This may take a sec...") if response.status_code..." - Network Request in src/webrunc/__init__.py: "requests.get(" ADDITIONAL FINDINGS - Shell Command Execution in src/webrunc/__init__.py: "subprocess.run(" PAYLOAD FILES src/webrunc/__init__.py