GCVE-110-OSM-2026-5743

Malicious package detected. Behaviors: data exfiltration. Entrypoint: icinga/__init__.py (module-import: 35) Exfil: https://python-log.lapxa354.workers.dev/ (custom-c2, recovery: decoded in icinga/__init__.py) Payload: icinga/__init__.py Key findings: - Decoded Base64 Content in icinga/__init__.py - Python File Upload to Remote in icinga/__init__.py: "urllib.request.Request( webhook_url, data=" - Data Encoding for Exfiltration in icinga/__init__.py: "json.dumps(payload).encode" IOCs: - urls: https://python-log.lapxa354.workers.dev/ - domains: python-log.lapxa354.workers.dev - payloadFileHash: ec64e461f625be075ca0725b9616625404e8a3e471ffd92310d1eaf05cecd12b Decoded/deobfuscated IOCs: - urls: https://python-log.lapxa354.workers.dev/ - domains: python-log.lapxa354.workers.dev