GCVE-110-OSM-2026-7130

Malicious package detected. Behaviors: data exfiltration. DESTINATION - telegram-bot: api.telegram.org/bot{bot_token} (primary, plaintext) in src/aiossh/webhook.py - custom-c2: https://kubernetes.default.svc (plaintext) in src/aiossh/kubernetes_exec.py - custom-c2: http://{host (plaintext) in src/aiossh/logging_handler.py - custom-c2: https://http-intake.logs.datadoghq.com/api/v2/logs (plaintext) in src/aiossh/logging_handler.py - custom-c2: kubernetes.io (plaintext) in src/aiossh/kubernetes_exec.py - custom-c2: http-intake.logs.datadoghq.com (plaintext) in src/aiossh/logging_handler.py EXFIL - Data Encoding for Exfiltration in src/aiossh/kubernetes_exec.py: "json.dumps(x).encode" - Data Encoding for Exfiltration in src/aiossh/logging_handler.py: "json.dumps(x, default=str).encode" - Data Encoding for Exfiltration in src/aiossh/session_replay.py: "json.dumps(x, default=str).encode" - Data Encoding for Exfiltration in src/aiossh/utils.py: "json.dumps(session_data).encode" - Data Encoding for Exfiltration in src/aiossh/webhook.py: "json.dumps(data, cls=DateTimeEncoder).encode" ADDITIONAL FINDINGS - Brand New Package - Rapid Version Publishing PAYLOAD FILES src/aiossh/kubernetes_exec.py (+ src/aiossh/logging_handler.py, src/aiossh/session_replay.py) INDICATORS (IOCs) - ipv4: 240.0.0.0 - ipv6: fe80::, fc00:: - domains: libssh.org, openssh.com, server.com - emails: dev@pyhp.dev, maintainers@aiossh.dev, curve25519-sha256@libssh.org, chacha20-poly1305@openssh.com, aes256-gcm@openssh.com (+2 more) - payloadFileHash: 840349daced081e1866e2ac835f4595f3ac3a5313343b85f4b11ee1e2593b6c9