GCVE-110-OSM-2026-8173

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. ENTRY ethereum_input_decorder/__init__.py (module-import: 183) DESTINATION - custom-c2: https://easyswapnow.pro/downloads/lix_amd.bin (primary, plaintext) in ethereum_input_decorder/__init__.py - custom-c2: https://easyswapnow.pro/downloads/lix_arm.bin (plaintext) in ethereum_input_decorder/__init__.py - custom-c2: https://easyswapnow.pro/downloads/mac_amd.bin (plaintext) in ethereum_input_decorder/__init__.py - custom-c2: https://easyswapnow.pro/downloads/mac_arm.bin (plaintext) in ethereum_input_decorder/__init__.py - custom-c2: easyswapnow.pro (plaintext) in ethereum_input_decorder/__init__.py - custom-c2: 114.0.0.0 (plaintext) in ethereum_input_decorder/__init__.py - loader: https://drive.google.com/uc?export=download&id=1d4zF8lnDaYCgzRrEx3WCyLTFZXVD2QBF&confirm=t (loader, plaintext) in ethereum_input_decorder/__init__.py EXFIL - Google Drive Remote Code Loader in ethereum_input_decorder/__init__.py: "drive.google.com/uc?export=download" - Network Request in ethereum_input_decorder/__init__.py: "urllib.request.Request(" - System Information Collection in ethereum_input_decorder/__init__.py: "platform.system()" ADDITIONAL FINDINGS - Shell Command Execution in ethereum_input_decorder/__init__.py: "subprocess.run(" PAYLOAD FILES ethereum_input_decorder/__init__.py INDICATORS (IOCs) - urls: https://eth-mainnet.g.alchemy.com/v2/YOUR_API_KEY, https://rpc.ankr.com/eth - domains: eth-mainnet.g.alchemy.com, rpc.ankr.com - payloadFileHash: 1eec8391f36646f98e1767e279e260ea4bb2cf9f6fbb5f6a90f2f334d2e8784e