GCVE-110-OSM-2026-5686

Malicious package detected. Behaviors: data exfiltration, code execution. Entrypoint: spaysdata/main.py (console-script: spaysdata-run=spaysdata.main:main_entry) Exfil: https://discord.com/api/webhooks/1513807955340820602/-UbLOjMGWIop17hrvQ7XsrZkJBJaNlMTueX7xnsJ9hz6DKaBgSe_Ur2FIgSJMHlusBwx (discord-webhook, recovery: plaintext in spaysdata/main.py) Payload: spaysdata/main.py Key findings: - Webhook Data Exfiltration in spaysdata/main.py: "discord.com/api/webhooks/1513807955340820602/-UbLOjMGWIop17hrvQ7XsrZkJBJaNlMTueX..." - Discord Token Theft in spaysdata/main.py: "discord\\Local Storage" - Shell Command Execution in spaysdata/main.py: "os.system(" - Data Encoding for Exfiltration in spaysdata/main.py: "base64.b64encode(" IOCs: - urls: https://discordapp.com/api/v6/users/@me - domains: discordapp.com - discordWebhooks: https://discord.com/api/webhooks/1513807955340820602/-UbLOjMGWIop17hrvQ7XsrZkJBJaNlMTueX7xnsJ9hz6DKaBgSe_Ur2FIgSJMHlusBwx - payloadFileHash: 8d609f7ccd0e47fe743299781b79230d96f8944fcba58b24d14950a113ca5908