GCVE-110-OSM-2026-14100

The package provides code to create an SSH session exposed via tunnels. By default, created session is accessible without any auth and reported to a hardcoded location, exposing any user to be accessed by attacker. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-sitecard Reasons (based on the campaign): - backdoor ENTRY src/sitecard/commands.py (console-script: sitecard=sitecard.commands:main) DESTINATION - 6 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Sensitive File Access in src/sitecard/gateway.py: ""~/.ssh/authorized_keys"" - Environment Variable Exfiltration in src/sitecard/model_relay.py: "os.environ.get("SSL_CERT_FILE") or os.environ.get("REQUESTS_CA_BUNDLE") connecti..." - Sensitive File Access in src/sitecard/session.py: ""~/.ssh/authorized_keys"" - Sensitive File Access in src/sitecard/transports.py: ""~/.ssh/authorized_keys"" - Data Encoding for Exfiltration in src/sitecard/model_relay.py: "json.dumps(payload).encode" - Python File Upload to Remote in src/sitecard/session.py: "urllib.request.Request( rendezvous_url, data=" - Data Encoding for Exfiltration in src/sitecard/wsroute.py: "base64.b64encode(" - System Information Collection in src/sitecard/account.py: "getpass.getuser()" (+2 more) ADDITIONAL FINDINGS - Shell Command Execution in src/sitecard/client_config.py: "subprocess.run(" - Silent Process Execution in src/sitecard/relay_host.py: "subprocess.DEVNULL" PAYLOAD FILES src/sitecard/session.py (+ src/sitecard/model_relay.py, src/sitecard/transports.py)