GCVE-110-OSM-2026-9131

The package exhibits a three-component dropper architecture: `activation.py` fingerprints the environment via `socket.gethostname()` (classic sandbox evasion), `client.py` downloads files from a remote host handling Content-Disposition headers (payload staging), and `remote.py` executes shell commands via `subprocess.run` (payload execution). The package name 'colorstack' with internal modules named `remote`, `activation`, and `client` under a `newcolors` namespace is a common misdirection pattern. Minimal metadata (no description, no repository, no homepage) fits the throwaway/burner profile typical of malware delivery packages. EXFIL - System Information Collection in src/newcolors/activation.py: "socket.gethostname()" ADDITIONAL FINDINGS - Shell Command Execution in src/newcolors/remote.py: "subprocess.run(" PAYLOAD FILES src/newcolors/activation.py INDICATORS (IOCs) - urls: https://www.fastsyncapi.com, https://example.test/v1/update, https://example.test - domains: www.fastsyncapi.com - payloadFileHash: 34bc9a41a9eb8177f1db3f9f6b229e8b1a193fa9568f35fa48bd99e5c4c134ff