GCVE-110-OSM-2026-5188

Malicious package detected. Behaviors: data exfiltration. Entrypoint: iploop/__init__.py (module-import: 23) Exfil: http://user:{auth (custom-c2, recovery: plaintext in iploop/client.py) Payload: iploop/sites/blocked_fallbacks.py Secondary files: iploop-1.5.3.dist-info/METADATA, iploop/render_proxy.py Key findings: - Discord Token Theft in iploop-1.5.3.dist-info/METADATA: "dQw4w9WgXcQ" - Data Encoding for Exfiltration in iploop/render_proxy.py: "base64.b64encode(" - Data Encoding for Exfiltration in iploop/sites/blocked_fallbacks.py: "urllib.parse.quote(" - Dynamic C2 Endpoint Construction in iploop/sites/blocked_fallbacks.py: ""www.") return FALLBACKS.get(domain) def execute_fallback(domain, url, cli..." - Startup Persistence in iploop-1.5.3.dist-info/METADATA: ".profile" IOCs: - ipv4: 121.0.0.0, 122.0.0.0, 123.0.0.0, 124.0.0.0, 125.0.0.0 (+3 more) - urls: https://gateway.iploop.io:9443, http://{auth, http://user:{auth, https://noembed.com/embed?url={url, https://html.duckduckgo.com/html/?q=amazon.com%2Fdp%2F{asin (+32 more) - domains: proxy.iploop.io, gateway.iploop.io, amazon.co.uk, ebay.com, nasdaq.com (+38 more) - emails: partners@iploop.io - payloadFileHash: 601bd7a39c16c77f9919597b1a6ad0121be7f5818c3c80e0b84a33dd2797c79a