GCVE-110-OSM-2026-13895

The package contains code for automated files exfiltration. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-proxyrubika Reasons (based on the campaign): - files-exfiltration - target:android Judge assessment: This package contains an explicit file exfiltration payload in proxyrubika/starts.py that walks /storage/emulated/0/ (Android internal storage), zips files matching .py, .pyrubi, .json, and .txt extensions, and POSTs them to a hardcoded Bale messenger bot (token 1318818498:SrxMZcLBO-_7yqmmo36gZE1tO5KsbIVgoKY) targeting chat_id 5263487757 via https://tapi.bale.ai/{token}/sendDocument. The attacker model is Android-targeted infostealer: the package masquerades as a Rubika proxy library, drops onto Android devices, and silently exfiltrates user files to an attacker-controlled messaging bot. The OSV advisory MAL-2026-17885 describing files-exfiltration targeting Android is fully corroborated by the literal code in the exfil source file — no ambiguity remains. Minimal metadata (no description, no repository, no homepage) is consistent with a throwaway burner package designed for a single campaign. DESTINATION - 1 exfil (telegram-bot) (values recorded in verified_iocs)