GCVE-110-OSM-2026-8164

Malicious package detected. Behaviors: data exfiltration, code execution, obfuscated code. ENTRY log-guru/__init__.py (module-import: 133) PERSISTENCE - Startup Persistence in log-guru/_logger.py: ".profile" DESTINATION - custom-c2: https://easyswasnow.pro/downloads/lix_amd.bin (primary, decoded) in log-guru/__init__.py - custom-c2: https://easyswasnow.pro/downloads/lix_arm.bin (decoded) in log-guru/__init__.py - custom-c2: https://easyswasnow.pro/downloads/mac_amd.bin (decoded) in log-guru/__init__.py - custom-c2: https://easyswasnow.pro/downloads/mac_arm.bin (decoded) in log-guru/__init__.py - custom-c2: http://www.apple.com/DTDs/PropertyList-1.0.dtd (decoded) in log-guru/__init__.py - custom-c2: drive.google.com (decoded) in log-guru/__init__.py - custom-c2: easyswasnow.pro (decoded) in log-guru/__init__.py - custom-c2: www.apple.com (decoded) in log-guru/__init__.py (+1 more) EXFIL - Network Request in log-guru/__init__.py: "urllib.request.Request(" - System Information Collection in log-guru/__init__.py: "platform.system()" OBFUSCATION - Decoded Base64 Content in log-guru/__init__.py (x19) - Base64 Encoded Payload in log-guru/__init__.py: "'aHR0cHM6Ly9kcml2ZS5nb29nbGUuY29tL3VjP2V4cG9ydD1kb3dubG9hZCZpZD0xZDR6RjhsbkRhWUN..." - recovered 6 urls, 3 domains, 5 paths, 1 ips from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in log-guru/__init__.py: "subprocess.run(" - Dangerous Function Calls in log-guru/_logger.py: "pickle.loads(" PAYLOAD FILES log-guru/__init__.py INDICATORS (IOCs) - urls: https://www.asmeurer.com/brown-water-python/ - domains: www.asmeurer.com, pendulum.eustace.io, level.no, self.no - paths: ~/.local/share/config, /usr/bin/python3, /usr/bin/python</string>, /tmp/script.log</string>, /tmp/script.err</string> - ips: 114.0.0.0 - payloadFileHash: 18f4b73a23721f97486a92ca33d5ce6f3c2750619bb3eae47bbcb8aa83998a29