GCVE-110-OSM-2026-10266

This appears to be a security researcher PoC package attempting to use a dependency confusion attack against SAP. However, the package exfiltrates /etc/passwd, all environment variables, and much more, which is beyond the standard researcher-style attack. EXFIL - Python File Upload to Remote in setup.py: "urllib.request.Request( ATTACKER_URL, data=" - Data Encoding for Exfiltration in setup.py: "json.dumps(report, indent=2).encode" - Network Request in setup.py: "urllib.request.Request(" - System Information Collection in setup.py: "socket.gethostname()" ADDITIONAL FINDINGS - Shell Command Execution in setup.py: "os.system(" PAYLOAD FILES setup.py