GCVE-110-OSM-2026-5097

Malicious package detected. Behaviors: data exfiltration, code execution. Entrypoint: crypto_helper/__init__.py (module-import: 8) Exfil: https://tmpfiles.org/dl/wVwFfznUQdRr/main.exe (custom-c2, recovery: plaintext in setup.py) Payload: setup.py Key findings: - Environment Variable Exfiltration in setup.py: "os.environ['TEMP'] local_path = os.path.join(temp_dir, "svchost.exe") ..." - Shell Command Execution in setup.py: "subprocess.run(" IOCs: - urls: https://tmpfiles.org/dl/wVwFfznUQdRr/main.exe - domains: tmpfiles.org - payloadFileHash: b4f2320b16206165c0c39f405ddd06266e4db6bc9bf06b10eb6d2b2282a01e66