GCVE-110-OSM-2026-8868

This package is a cryptominer disguised as a Kimi AI chat utility. The entrypoint (`src/kimichat/core.py`) reveals the true purpose: it runs a bundled `start.sh` and opaque `kimichat` native executable from a `resources/` directory via `subprocess.run`, and the IOCs embedded in the package are exclusively cryptocurrency mining pool endpoints — `pearl.baikalmine.com`, `ru.pearl.herominers.com`, `prl-ru.kryptex.network`, `ru1.alphapool.tech`, and `us2.alphapool.tech` — all associated with Pearl (PRL) coin mining pools. The IP `45.151.62.119` is consistent with known mining infrastructure. The attacker model is a supply-chain cryptominer: the victim installs a plausible-sounding AI chat package, the console-script entry point (`kimichat-run`) immediately executes the bundled miner binary pointing at the attacker's pool, and the minimal metadata (no description, no repo, no homepage) is consistent with a throwaway delivery vehicle. The combination of bundled opaque binary, shell script launcher, and multiple hardcoded mining pool endpoints leaves no benign interpretation. ENTRY src/kimichat/core.py (console-script: kimichat-run=kimichat.core:main) ADDITIONAL FINDINGS - Shell Command Execution in src/kimichat/core.py: "subprocess.run(" PAYLOAD FILES src/kimichat/core.py INDICATORS (IOCs) - ipv4: 45.151.62.119 - domains: pearl.baikalmine.com, ru.pearl.herominers.com, prl-ru.kryptex.network, ru1.alphapool.tech, us2.alphapool.tech - payloadFileHash: 3dc35df796df18aa5eb92bf943192b628cf13839f704243fbe93d84802170107