GCVE-110-OSM-2026-9567

This package implements a private key exfiltration backdoor. The function `perm(private_key)` in `trongriden/main.py` accepts a cryptocurrency private key and POSTs it as JSON to an attacker-controlled ngrok tunnel at `https://reda-sequestered-justine.ngrok-free.dev/tron`, then fetches a command-and-control endpoint at `/switcher` to receive further instructions. The attacker model is a supply-chain credential theft targeting Tron blockchain private keys — the package name 'trongriden' and the endpoint path `/tron` both confirm the targeting. The ngrok tunnel (`reda-sequestered-justine.ngrok-free.dev`) is a classic ephemeral C2 infrastructure choice to avoid static IP blocklists. There is no legitimate explanation for a PyPI package with no description or repository to be POSTing private keys to a personal ngrok subdomain. DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in trongriden/main.py: "requests.post(" ADDITIONAL FINDINGS - Ngrok Tunneling Service in trongriden/main.py: "ngrok-free.dev" PAYLOAD FILES trongriden/main.py