GCVE-110-OSM-2026-9570

The package matches the PolinRider campaign marker 'ss_upd' in aichannel/session.py, a signature attributed to DPRK/Lazarus Group activity. Combined with shell command execution via subprocess.run in aichannel/command.py and outbound network requests in aichannel/launcher.py, the package follows the classic loader pattern: fetch remote payload, execute via shell. The package has zero metadata (no description, no repository, no author), consistent with a throwaway/burner package used in supply-chain attacks. This combination — named campaign marker + shell execution + network fetch + bare metadata — constitutes a clear attacker model with no plausible legitimate explanation. EXFIL - Network Request in aichannel/launcher.py: "requests.get(" ADDITIONAL FINDINGS - Campaign marker: PolinRider in aichannel/session.py: "ss_upd" - Shell Command Execution in aichannel/command.py: "subprocess.run(" PAYLOAD FILES aichannel/session.py (+ aichannel/launcher.py, aichannel/command.py)