GCVE-110-OSM-2026-13894

The package contains code for automated files exfiltration. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-proxyrubika Reasons (based on the campaign): - files-exfiltration - target:android Judge assessment: The package contains an explicit file exfiltration function in `proxyrobika/starts.py` that walks `/storage/emulated/0/` (Android internal storage), zips files matching `.json`, `.py`, `.pyrubi`, and `.txt` extensions, and POSTs them to a hardcoded Bale bot endpoint (`https://tapi.bale.ai/bot{token}/sendDocument`) using a hardcoded bot token `1263262891:neVZzZ8aKyH25k8BADzDkkurSehW3NuWgrg` and chat ID `5263487757`. The attacker model is straightforward: a developer tool targeting Android environments (likely Rubika/Pyrubi bot developers) that silently exfiltrates source code and configuration files containing credentials or session tokens. The OSV advisory MAL-2026-17889 describing files-exfiltration targeting Android is fully corroborated by the actual source code. DESTINATION - 1 exfil (telegram-bot) (values recorded in verified_iocs)