GCVE-110-OSM-2026-9568

The package implements a classic remote-bytecode-execution backdoor: `wacve_utils/update_checker.py` fetches data from a hardcoded raw IP address (2.23.12.75) via `requests.get()` and then deserializes the response with `marshal.loads()`. Python's `marshal` module can deserialize compiled bytecode objects, meaning any arbitrary Python code compiled server-side will execute in the victim's interpreter. This pattern — fetch-from-attacker-IP then marshal.loads — is a well-known loader technique requiring no shell-level execution to achieve full RCE. The publisher 'ceroequisveinte' has zero prior packages, no repository, no email, and the description ('chat application security checks') is generic camouflage. The static scorer underweighted this because it treated the findings as isolated; in combination they are unambiguous. EXFIL - Network Request in wacve_utils/update_checker.py: "requests.get(" ADDITIONAL FINDINGS - Dangerous Function Calls in wacve_utils/update_checker.py: "marshal.loads(" PAYLOAD FILES wacve_utils/update_checker.py