GCVE-110-OSM-2026-10133

This looks like a dep-confusion or burner-package malware implant whose attacker model is straightforward: collect host fingerprinting data on import and exfiltrate it to a hardcoded Discord webhook. The entrypoint in `setup.py` uses an install hook (`cmdclass={'build_py': BuildPyWithPTH}`) to ensure packaging artifacts are installed, while `riakcs/__init__.py` immediately runs `_startup_diagnostic()` and posts `getpass.getuser()`, `socket.gethostname()`, `platform.platform()`, `sys.executable`, and `os.getcwd()` via `requests.post()` to the Discord URL. The plaintext webhook IOC and the package’s minimal metadata/no repository shape are consistent with a malicious package meant to steal environment context from infected developer machines rather than a legitimate library. ENTRY setup.py (install-hook: install/develop/build override present) DESTINATION - 1 exfil (discord-webhook) (values recorded in verified_iocs) EXFIL - Webhook Data Exfiltration in riakcs/__init__.py: "discord.com/api/webhooks/1533912548318117932/Z7bXaOd9_eJuWhnqYwASpO334Ey9LJQrY62..." - Network Request in riakcs/__init__.py: "requests.post(" - System Information Collection in riakcs/__init__.py: "socket.gethostname()" PAYLOAD FILES riakcs/__init__.py