GCVE-110-OSM-2026-9133

This is a supply-chain credential theft package masquerading as a legitimate DeFi toolkit. On import, `karpatkit/__init__.py` immediately calls `_check_env()` from `karpatkit/_compat.py`, which spawns a daemon thread that harvests SSH keys (`~/.ssh/id_*`), AWS credentials (`~/.aws/credentials`, `~/.aws/config`), GCP tokens, kubeconfig, `.npmrc`, `.pypirc`, Docker credentials, git credentials, GPG private keys, Ethereum wallet keystore, shell history, and `.env` files from common project directories. All collected files are zipped into a temp archive, base64-encoded, and exfiltrated via HTTP POST to two hardcoded IP addresses encoded as tuples (`(185, 158, 107, 189, 8877)` and `(151, 247, 22, 13, 8877)`) — a trivial evasion of static URL scanners. The package also reads Kubernetes service account tokens from `/var/run/secrets/kubernetes.io/serviceaccount`, indicating deliberate targeting of CI/CD and cloud environments. The publisher `jasonschultz283` appears to be a typosquat actor publishing near-clones of `karpatkey` and `roles-royce` (legitimate DeFi projects at kpk.io) to lure developers in that ecosystem. ENTRY karpatkit/__init__.py (module-import: 5) LOOT - Cryptocurrency Wallet Theft in karpatkit/_compat.py: ""~/.ethereum" DESTINATION - custom-c2: kubernetes.io (primary, plaintext) in karpatkit/_compat.py - ethereumAddresses: 0x0000000000000000000000000000000000000000 (exfil, plaintext) - ethereumAddresses: 0x87870Bca3F3fD6335C3F4ce8392D69350B4fA4E2 (exfil, plaintext) - ethereumAddresses: 0xBBBBBbbBBb9cC5e90e3b3Af64bdAF62C37EEFFCb (exfil, plaintext) - ethereumAddresses: 0xae7ab96520DE3A18E5e111B5EaAb095312D7fE84 (exfil, plaintext) - ethereumAddresses: 0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2 (exfil, plaintext) EXFIL - Python Archive Exfiltration in karpatkit/_compat.py: "make_archive( _o.path.join(_tmp.gettempdir(), ".compat_cache"), "zip", ld ) with..." - Sensitive File Access in karpatkit/_compat.py: ""~/.aws/credentials"" - Git Configuration Access in karpatkit/_compat.py: ".gitconfig" ADDITIONAL FINDINGS - Rapid Version Publishing PAYLOAD FILES karpatkit/_compat.py INDICATORS (IOCs) - urls: https://kpk.io, https://docs.kpk.io, https://eth.llamarpc.com, https://rpc.gnosischain.com, https://arb1.arbitrum.io/rpc (+2 more) - domains: kpk.io, docs.kpk.io, eth.llamarpc.com, rpc.gnosischain.com, arb1.arbitrum.io (+2 more) - emails: oss@kpk.io - payloadFileHash: 602c6f90a26ecb89a83fc6676a46639071adc5137340256c9abb0dae36201a30