GCVE-110-OSM-2026-14101

Malicious package detected. Behaviors: data exfiltration, code execution, network activity, obfuscated code. ENTRY bravos/__init__.py (module-import: 3) PERSISTENCE - Startup Persistence in bravos/adapters/cxg.py: ".profile" - Startup Persistence in bravos/adapters/cxg_bridge.py: ".profile" - Startup Persistence in bravos/adapters/cxg_report.py: ".profile" - Startup Persistence in bravos/cli.py: ".profile" - Startup Persistence in bravos/commands/auto.py: ".profile" - Startup Persistence in bravos/commands/env_cmd.py: ".profile" - Startup Persistence in bravos/commands/intake_cmd.py: ".profile" - Startup Persistence in bravos/commands/replay.py: ".profile" (+19 more) DESTINATION - 18 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Corporate Environment Targeting in bravos/adapters/guardlink_model.py: "tModel.unmitigated_exposures`, so the two surfaces that read them — the pentest" - Corporate Environment Targeting in bravos/coverage_inventory.py: "tModel` and the round's :class:`~bravos.graph_worklist.Worklist`, so every branc..." - OAST/Interactsh Exfiltration in bravos/env/canary.py: "oast.site" - OAST/Interactsh Exfiltration in bravos/intake/derive.py: "oast.online" - Corporate Environment Targeting in bravos/sast_threat_match.py: "tModel, facts: GraphFacts ) -> tuple[tuple[SastFinding, ...], ThreatMatch" - Corporate Environment Targeting in bravos/targeting.py: "tModel from .errors import BravosError from .models.cxg_execution import executi..." - Data Encoding for Exfiltration in bravos/artifact.py: "base64.b64encode(" - Python File Upload to Remote in bravos/env/login.py: "urllib.request.Request(url, data=" (+20 more) OBFUSCATION - Unicode Escape Obfuscation in bravos/models/identity.py: "\u1680\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007" ADDITIONAL FINDINGS - Download Execute Delete Pattern in bravos/threat_draft.py: "exec", "filesystem", "data_layer"}) #: A call-chain segment (``std::fs::remove_f..." - Base64 Decoded Eval in bravos/web/assets/embed_assets.py: "compile(r'(url\("data:font/otf;base64" - Silent Process Execution in bravos/adapters/guardlink.py: "stdin=DEVNULL" - Shell Command Execution in bravos/commands/config_cmd.py: "subprocess.call(" - Dynamic Code Execution in bravos/models/sast.py: "vm.runInContext" - Brand New Package PAYLOAD FILES bravos/env/login.py (+ bravos/intake/derive.py, bravos/env/canary.py)