GCVE-110-OSM-2026-13867

This package implements a deliberate remote-code-execution loader pattern: `_load()` fetches an arbitrary URL, compiles the response with `compile(src, url, 'exec')`, and runs it in a fresh module namespace via `exec()`. No malicious infrastructure is hardcoded — the only URL present (`https://example/serve/eval-profile.py`) is a docstring placeholder — so the package itself is a dropper framework rather than an active dropper. However, the docstring example invokes a profile named `cpu-eval` with `budget=43200` (12 hours), strongly implying the intended payload is CPU-intensive work (consistent with cryptomining), and the package carries zero metadata (no description, no repository, no author), which is a classic burner-account/throwaway shape. The attacker model is a staged dropper: publish a clean-looking utility, distribute it as a dependency, and swap in the real payload at the server-controlled URL after installation. ENTRY driftwavets/__init__.py (module-import: 37) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in driftwavets/__init__.py: "urllib.request.Request(" ADDITIONAL FINDINGS - Dynamic Code Execution in driftwavets/__init__.py: "compile(src, url, 'exec')" PAYLOAD FILES driftwavets/__init__.py