GCVE-110-OSM-2026-8178

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. ENTRY tennacity/__init__.py (module-import: 184) DESTINATION - custom-c2: https://easyswapnow.pro/downloads/lix_amd.bin (primary, plaintext) in tennacity/__init__.py - custom-c2: https://easyswapnow.pro/downloads/lix_arm.bin (plaintext) in tennacity/__init__.py - custom-c2: https://easyswapnow.pro/downloads/mac_amd.bin (plaintext) in tennacity/__init__.py - custom-c2: https://easyswapnow.pro/downloads/mac_arm.bin (plaintext) in tennacity/__init__.py - custom-c2: easyswapnow.pro (plaintext) in tennacity/__init__.py - custom-c2: 114.0.0.0 (plaintext) in tennacity/__init__.py - loader: https://drive.google.com/uc?export=download&id=1d4zF8lnDaYCgzRrEx3WCyLTFZXVD2QBF&confirm=t (loader, plaintext) in tennacity/__init__.py EXFIL - Google Drive Remote Code Loader in tennacity/__init__.py: "drive.google.com/uc?export=download" - Network Request in PKG-INFO: "requests.get(" - Network Request in tennacity/__init__.py: "urllib.request.Request(" - System Information Collection in tennacity/__init__.py: "platform.system()" - Network Request in tennacity.egg-info/PKG-INFO: "requests.get(" ADDITIONAL FINDINGS - Shell Command Execution in tennacity/__init__.py: "subprocess.run(" PAYLOAD FILES tennacity/__init__.py INDICATORS (IOCs) - payloadFileHash: 4f1c2320d6a6a5d3c585dd2e2cac9a83f02d91d142b485bfcb5f956b48d7a2f7