GCVE-110-OSM-2026-14822

GitHub repository posing as a ZIP-321 Zcash payment URI validator and normalizer (CLI and library). It was created by the account behind the malicious zip321-uri and lwd-uri-util repositories, which target Zcash and wallet developers with credential-stealing code. The repository was removed from GitHub before its contents could be examined, so its exact behavior is unconfirmed. It is reported because of its publisher, its matching theme and naming pattern, and its creation after the campaign was publicly documented. Malicious payload found in: unknown (not stated in source) The repository was taken down before it could be inspected, so no code was reviewed and no payload has been confirmed. The only surviving record is an automated GitHub new-repository event showing it was created on 2026-11-10 with the description "Validate and normalize ZIP-321 zcash: payment URIs (CLI + library)". It follows the same theme and naming pattern as two sibling repositories by the same account that are confirmed credential stealers.