GCVE-110-OSM-2026-14102

Malicious package detected. Behaviors: data exfiltration, code execution. DESTINATION - 4 exfil (telegram-bot, custom-c2) - 2 c2 (telegramUsers, telegramChats) (values recorded in verified_iocs) EXFIL - Python File Upload to Remote in src/qowa/__init__.py: "urllib.request.Request(url, data=" - System Information Exfiltration in src/qowa/__init__.py: "socket.gethostname() head = {"X-Key": key} def api(method, path, **kw): kw.setde..." - Data Encoding for Exfiltration in src/qowa/__init__.py: "json.dumps({"chat_id": chat, "text": text, "parse_mode": "HTML"}).encode" - Network Request in src/qowa/__init__.py: "requests.get(" - System Information Collection in src/qowa/__init__.py: "socket.gethostname()" ADDITIONAL FINDINGS - Shell Command Execution in src/qowa/__init__.py: "subprocess.check_output(" - Brand New Package PAYLOAD FILES src/qowa/__init__.py TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @Ghgccttcttcc5cx_bot (id 8785478103) - 1 chat(s), 2 total member(s) observed - Threat-actor accounts: @BBCArablic