GCVE-110-OSM-2026-10141

This looks like an import-time credential and environment stealer intended for package-install or module-import compromise, consistent with a malicious publisher harvesting developer secrets. The top-level code in `dlmm-sdk/__init__.py` collects `os.environ` keys containing `TOKEN`, `SECRET`, `AWS`, `GITHUB`, `SOLANA`, and reads `~/.npmrc`, `~/.gitconfig`, `~/.ssh`, `~/.aws`, and cloud config directories before POSTing the JSON to a hardcoded `https://webhook.site/...` exfil endpoint. The attacker model is clear: steal local credentials and wallet-related material from a developer machine and send it to a custom C2/webhook service. The minimal metadata and empty repository further fit a throwaway package used for credential theft rather than a legitimate SDK. ENTRY dlmm-sdk/__init__.py (module-import: 46) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in dlmm-sdk/__init__.py: "webhook.site" - Python File Upload to Remote in dlmm-sdk/__init__.py: "urllib.request.Request( 'https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b..." - Git Configuration Access in dlmm-sdk/__init__.py: ".gitconfig" - Network Request in dlmm-sdk/__init__.py: "Request( 'https:" - System Information Collection in dlmm-sdk/__init__.py: "socket.gethostname()" PAYLOAD FILES dlmm-sdk/__init__.py