GCVE-110-OSM-2026-8370

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. DESTINATION - custom-c2: 91.149.191.134 (primary, plaintext) in src/BuffParser/main.py EXFIL - Reverse Shell in src/BuffParser/main.py: "socket.socket(socket.AF_INET, socket.SOCK_STREAM) sock.settimeout(10) sock.conne..." - Network Request in src/BuffParser/main.py: "urllib.request.urlopen(" ADDITIONAL FINDINGS - Shell Command Execution in src/BuffParser/main.py: "subprocess.Popen(" PAYLOAD FILES src/BuffParser/main.py INDICATORS (IOCs) - domains: Buff.163.com, cs2-tools.com - emails: maint@cs2-tools.com - payloadFileHash: 4e1ff0b9a91af60ea5d534cb435570434b5bc4f9379a25038f30ce503d6a913b