GCVE-110-OSM-2026-8355

Suspicious package detected. Behaviors: data exfiltration. DESTINATION - telegram-bot: api.telegram.org/bot{self._token} (primary, plaintext) in oracle_lag_sniper/telegram.py - telegram-bot: api.telegram.org/bot<TOKEN (plaintext) in oracle_lag_sniper/telegram.py - custom-c2: https://api-gateway{chunks_b (plaintext) in oracle_lag_sniper/sanity.py - custom-c2: https://polygonscan.com/tx/{tx_hash (plaintext) in oracle_lag_sniper/telegram.py - custom-c2: polygonscan.com (plaintext) in oracle_lag_sniper/telegram.py - ethereumAddresses: 0x0021dc8221add18a125d57bbcb22f4af1fb8cb9e (exfil, plaintext) - ethereumAddresses: 0x00ae9071065879c15f2da4497d8e79de0493f6ca (exfil, plaintext) - ethereumAddresses: 0x02b14504d7e7ea9fc05f856629509decc5bd6aa7 (exfil, plaintext) (+47 more) EXFIL - Network Request in oracle_lag_sniper/comments.py: "http.get(" - Network Request in oracle_lag_sniper/market.py: "http.get(" - Network Request in oracle_lag_sniper/sanity.py: "http.get(" - Network Request in oracle_lag_sniper/telegram.py: "http.get(" PAYLOAD FILES oracle_lag_sniper/comments.py (+ oracle_lag_sniper/market.py, oracle_lag_sniper/sanity.py) INDICATORS (IOCs) - urls: https://api.dataengine.chain.link, https://pm-ds-request.streams.chain.link/, https://api.binance.com/api/v3/aggTrades - domains: ws.dataengine.chain.link, api.dataengine.chain.link, pm-ds-request.streams.chain.link, api.binance.com, help.unicef.org - payloadFileHash: aba7b805c8fc4e0a084a53fd7ec073795451b7d83b5d510969965fae1e948e70