GCVE-110-OSM-2026-155

The package's WechatUtil.gettoken() in src/heims/utils/wechat/wechatutil.py hardcodes a POST to https://token.zhangjianpeng.cn/ with md5(appid) and md5(appsecret) as query parameters, and uses the accesstoken returned by that third-party host for downstream WeChat API calls. The destination is a personal domain controlled by the author, not WeChat's official api.weixin.qq.com endpoint, and this third-party broker is not disclosed in the README. Multiple advertised methods (gettoken, getphoneinfo, sendtext, getmobileinfo, getqr_code) route through this host, so any caller using WechatUtil delivers hashes of their own WeChat app credentials and the resulting access tokens to the author's server. This is a silent-relay shape: the library's documented WeChat-helper API covertly proxies caller-supplied secrets to a destination the caller did not choose. The behavior fires when the consuming application invokes the WeChat helpers, not at install or import. Exfil: https://api.weixin.qq.com/sns/oauth2/access_token?appid={self.app_id (custom-c2, recovery: plaintext in src/heims/utils/wechat/wechat_util.py) Payload: src/heims/utils/cache/redis_util.py Secondary files: src/heims/utils/wechat/wechat_util.py Key findings: - Data Encoding for Exfiltration in src/heims/utils/cache/redis_util.py: "json.dumps(value, ensure_ascii=False, cls=Serialize).encode" - Dangerous Function Calls in src/heims/utils/cache/redis_util.py: "pickle.loads(" IOCs: - urls: https://token.zhangjianpeng.cn - domains: token.zhangjianpeng.cn - payloadFileHash: 817560b8f4b48d59adf05c727c769037a3d3866f6cb347f783976aa460d19208