GCVE-110-OSM-2026-13866

This package is a sophisticated sandbox-escape and account-destruction payload masquerading as a Ukrainian locale helper library. The docstring is unusually self-documenting about its own attack chain: it explicitly describes targeting Hotaru's host-side import probe (which runs without seccomp/audit hooks/network blocks), scanning for Telegram session vault files via HOTARU_ACCOUNT_ROOT/HOTARU_ACCOUNT_SESSION env hints and glob patterns, loading the full Telegram TL schema to invoke account.deleteAccount, and then deleting the vault and session files to cover tracks. Version 1.2.8 adds persistence by patching the victim's local Hotaru checkout (hotaru/__main__.py) with an idempotent marker line after apply_vault_key_env(). The IPs in the IOCs (149.154.167.x, 149.154.175.x, 91.108.56.x) are Telegram MTProto datacenter addresses, consistent with the described RPC calls. The OSV advisory MAL-2026-17919 describing destructive actions and sandbox escape is fully corroborated by the visible source code, which reads as a multi-version attack changelog complete with bug fixes for previous failed payload attempts. ENTRY ukraine69/__init__.py (module-import: 722) ADDITIONAL FINDINGS - Download Execute Delete Pattern in ukraine69/__init__.py: "spawns an isolated `python -I` child, reloads TL schema, sends account.deleteAcc..." - Silent Process Execution in ukraine69/__init__.py: "stdout=_sp.DEVNULL" PAYLOAD FILES ukraine69/__init__.py