GCVE-110-OSM-2026-14405

Clone of a legitimate Pydantic package with the added downloading of a remote code. The remote code is delivered from the GitHub repository and unpacked as a new module and then called during initialization of any models (runner injected into cloned Pydantic code). During analysis, the remote code was just a placeholder. ENTRY pyprig/__init__.py (module-import: 376) DESTINATION - 5 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in pyprig/types.py: "base64.b64encode(" OBFUSCATION - Decoded Base64 Content in pyprig/types.py (x4) ADDITIONAL FINDINGS - Shell Command Execution in pyprig/_internal/_git.py: "subprocess.check_output(" - Dangerous Function Calls in pyprig/deprecated/parse.py: "pickle.loads(" - Brand New Package PAYLOAD FILES pyprig/types.py