GCVE-110-OSM-2026-8712

This package pretends to be a legitimate web3 contract tool: "Solidity development helpers — ABI encoding, contract verification utils". However, the init file embeds a base64 payload that decodes to an ELF binary. This ELF binary is a malicious cryptocurrency wallet stealer and credential harvester written in Rust. It targets developers and cryptocurrency users by searching for sensitive files, including Solana wallets (/.config/solana/id.json), Ethereum keystores (/.ethereum/keystore), Foundry keystores (/.foundry/keystores), Hardhat/Buidler configurations, and Docker volumes. Collected data is encrypted using a hardcoded RSA public key and exfiltrated via curl to various file-sharing services (uguu.se, temp.sh, transfer.sh) and IPFS via the Pinata API (api.pinata.cloud). It also establishes persistence on the infected host by installing a cron job (0 */12 * * *) to execute itself periodically. ENTRY solidity_dev/__init__.py (module-import: 8583) ADDITIONAL FINDINGS - Shell Command Execution in solidity_dev/__init__.py: "subprocess.check_output(" - Silent Process Execution in solidity_dev/__init__.py: "stderr=subprocess.DEVNULL" PAYLOAD FILES solidity_dev/__init__.py INDICATORS (IOCs) - payloadFileHash: 725c9770cafce248d5ed1cbb948b8e6bc3d0c3257258f29da2cce93396c9c220