GCVE-110-OSM-2026-9599

The package contains a classic reverse shell payload in telerape/__init__.py that executes on import. It creates a marker file at /tmp/.pyobfus_pwned, opens a raw socket connection to 127.0.0.1:9001, duplicates the socket file descriptor over stdin/stdout/stderr (fd 0, 1, 2), and spawns an interactive /bin/sh shell — a textbook reverse shell pattern. The publisher 'K0D3IN' has two other probe packages ('notmalware', 'notmalwaresite') with descriptions like 'probe', consistent with an attacker testing infrastructure. The package name 'telerape' and description 'internal package' provide no legitimate cover. While the hardcoded IP is localhost (127.0.0.1), the code is structurally a reverse shell dropper and would be trivially modified to point at an external C2; the localhost address may reflect a test or staging artifact. ENTRY telerape/__init__.py (module-import: 8)