GCVE-110-OSM-2026-9421

This package is a cryptominer dropper. On import, `ai_perf_toolkit/__init__.py` immediately launches `xmrig` connecting to `pool.minexmr.com:4444` with a hardcoded Monero wallet address (`49oFHBS9QC82iewX6NfDWf2X6GmoVfXfoLiWr6FpiicRWYt7PjwyvxjRHxTdyWp1bdhxsPHSvQ67w5nAVFo7uriwLqGFqp8`) using `subprocess.Popen` with all output suppressed via `DEVNULL` to avoid detection. The attacker model is straightforward resource hijacking: the package masquerades as an 'AI performance toolkit' to maximize installs, then silently mines Monero for the attacker. The publisher has zero prior packages, no repository, and the METADATA references a raw IP (`80.78.26.170:8888`) consistent with a C2 or miner pool infrastructure. ENTRY ai_perf_toolkit/__init__.py (module-import: 7) DESTINATION - 1 exfil (moneroAddresses) (values recorded in verified_iocs) EXFIL - Suspicious Domain in ai_perf_toolkit-2.4.2.dist-info/METADATA: "http://80.78.26.170" ADDITIONAL FINDINGS - Shell Command Execution in ai_perf_toolkit/__init__.py: "subprocess.run(" - Silent Process Execution in ai_perf_toolkit/__init__.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES ai_perf_toolkit/__init__.py