GCVE-110-OSM-2026-9032

Malicious package detected. Behaviors: data exfiltration, code execution. ENTRY govpkg/__init__.py (module-import: 8) DESTINATION - custom-c2: https://teeny-cent.surge.sh/client (primary, decoded) in govpkg/_internal.py - custom-c2: http://pkg.go.dev/ (plaintext) in govpkg/govpkg.py - urls: https://pkg.go.dev/github.com/spf13/cobra (c2, plaintext) - urls: https://pkg.go.dev (c2, plaintext) - urls: https://pkg.go.dev/ (c2, plaintext) - domains: pkg.go.dev (c2, plaintext) EXFIL - Network Request in govpkg/_internal.py: "requests.get(" - Network Request in govpkg/govpkg.py: "requests.get(" OBFUSCATION - Decoded Base64 Content in govpkg/_internal.py - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in govpkg/_internal.py: "subprocess.Popen(" - Silent Process Execution in govpkg/_internal.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES govpkg/_internal.py INDICATORS (IOCs) - payloadFileHash: e12c648689cc17ee89be1c21037bd8fe3a0af8be2f584069fc2a8b3a02dd359f