GCVE-110-OSM-2026-3047

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. Payload: pypi/elitea-sdk@0.6.4/elitea_sdk/tools/testio/api_wrapper.py Secondary files: pypi/elitea-sdk@0.6.4/elitea_sdk/cli/tools/terminal.py, pypi/elitea-sdk@0.6.4/elitea_sdk/configurations/openapi.py Key findings: - Sensitive File Access in pypi/elitea-sdk@0.6.4/elitea_sdk/cli/tools/terminal.py: ""/etc/passwd"" - Corporate Environment Targeting in pypi/elitea-sdk@0.6.4/elitea_sdk/tools/testio/api_wrapper.py: "tModel", exploratory_test_id=(int, Field(description="The ID..." - Corporate Environment Targeting in pypi/elitea-sdk@0.6.4/elitea_sdk/tools/zephyr_enterprise/api_wrapper.py: "tModifiedOn")), "id": str(test_case.get("id")), ..." - Corporate Environment Targeting in pypi/elitea-sdk@0.6.4/elitea_sdk/tools/zephyr_scale/api_wrapper.py: "tModel = create_model( "ZephyrTestStepsInputModel", test" - Data Encoding for Exfiltration in pypi/elitea-sdk@0.6.4/elitea_sdk/cli/tools/filesystem.py: "base64.b64encode(" IOCs: - ipv4: 4.11.0.86 - urls: http://www.apache.org/licenses/, http://www.apache.org/licenses/LICENSE-2.0, https://elitea.ai, https://api.elitea.ai, https://api.elitea.ai\n (+45 more) - domains: www.apache.org, epam.com, docs.pydantic.dev, click.group, docs.langchain.com (+36 more) - emails: mikalai_biazruchka@epam.com, roman_mitusov@epam.com, john.smith@yourcompany.com, SupportAlita@epam.com, john.doe@epam.com - payloadFileHash: 06f98be61eb7e01cc6ea9eda8e740b9a3faea00c358235a77781471eed61fbe4