Deceptive repository distributing malware and harvesting private keys

[NIYASNICHU]

This repository contains critical vulnerabilities that allow Remote Code Execution (RCE) and has been actively exploited to exfiltrate private keys (.env files) from user machines.

Vulnerabilities:

• CVE-2026-7058 (RCE via simulation_ipc.py)
• CVE-2026-7054 / CVE-2026-7042 (No authentication on 50+ endpoints)
• Flask server running with Werkzeug debugger exposed on 0.0.0.0

If you have run this application locally, assume any private keys, OpenAI API keys, or database credentials stored on your machine are compromised. Terminate the application, rotate all keys immediately, and delete the repository.