GCVE-110-OSM-2026-10142

This is a credential-and-environment stealer that exfiltrates data on import to a hardcoded webhook.site endpoint, which matches an attacker model of opportunistic npm/PyPI package compromise or typosquatting. The top-level `report()` call in `dlmm/__init__.py` collects `socket.gethostname()`, `getpass.getuser()`, `os.getcwd()`, selected environment variables, `.npmrc`, `.gitconfig`, `.ssh`, `.aws`, and cloud config directories, then POSTs them to `https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b09`. The package is also minimally attributed and has no repository or meaningful description, which is consistent with a burner package designed for silent data theft. The `__import__(pkg_dir)` dynamic import in `setup.py` is additional suspicious infrastructure, but the exfiltration behavior alone is decisive. ENTRY dlmm/__init__.py (module-import: 46) DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in dlmm/__init__.py: "webhook.site" - Python File Upload to Remote in dlmm/__init__.py: "urllib.request.Request( 'https://webhook.site/326b0891-2093-4800-a4c1-686ce3e07b..." - Git Configuration Access in dlmm/__init__.py: ".gitconfig" - Network Request in dlmm/__init__.py: "Request( 'https:" - System Information Collection in dlmm/__init__.py: "socket.gethostname()" PAYLOAD FILES dlmm/__init__.py