GCVE-110-OSM-2026-734

Typosquat of legitimate finch bioinformatics tool that acts as a malware loader, secretly depending on sha-rust credential stealer which automatically updates to latest malicious version via unpinned dependency. Appears as legitimate genomic MinHashing tool with nearly identical functionality to finch v0.6.2, but includes single malicious line (sha_rust::from_str()) in src/filtering.rs that triggers credential stealer during sketch serialization. Uses unpinned dependency 'sha-rust = "0.1"' to auto-deliver latest malware variant to all victims.