GCVE-110-OSM-2026-14115

During import, obfuscated code downloads and executes an infostealer. Campaign shares some similarities with the campaign 2026-10-fontcase. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-getpubip Reasons (based on the campaign): - Downloads and executes a remote executable. - infostealer - exfiltration-browser-data - obfuscation Judge assessment: This package implements the Invisible Ferret obfuscation pattern associated with DPRK/Lazarus threat actors: a multi-layer lambda-exec chain using zlib decompression of reversed base64 content (`zlib').decompress(__import__('base64').b64decode(__[::-1]))`) in `getpubip/__init__.py`. The deobfuscation layer unwrapped 10 nested lambda-exec layers and recovered a C2 download URL (`https://api-bsx.pages.dev/download`), consistent with the OSV advisory's description of an infostealer that downloads and executes a remote payload on import. The package name 'getpubip' is a plausible cover for the legitimate `core.py` which queries ipify.org, but the actual malicious payload is embedded in `__init__.py` and executes on import before any user code runs. Minimal metadata (no description, no repo, no homepage) is the classic burner-account throwaway shape used in supply chain attacks of this campaign family. OBFUSCATION - Python Lambda Exec Obfuscation Unwrapped in getpubip/__init__.py - Base64 Encoded Payload in getpubip/__init__.py: "'JfjqAHw//+7vWAKT9KGrcdM/y9WJWEZ4oPVlNloZOOr89gzIXIuM8xsTqKKHPYryHUlkLXoinISFdbp..." - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Invisible Ferret Obfuscation in getpubip/__init__.py: "zlib').decompress(__import__('base64').b64decode(__[::-1]))" - Invisible Ferret Lambda Exec Pattern in getpubip/__init__.py: "exec((_)(" PAYLOAD FILES getpubip/__init__.py