GCVE-110-OSM-2026-11043

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation. Judge assessment: This is an install-time exfiltration payload targeting the host machine: `setup.py` overrides `cmdclass={"install": CustomInstall}` and runs `subprocess.check_output(["cat", "/etc/passwd"], stderr=subprocess.DEVNULL, text=True)` during installation. It then sends the captured output to the hardcoded `https://webhook.site/e59aa239-1a6b-41d0-b87b-242f4da8f90c` using `requests.post(...)` or `urllib.request.urlopen(...)`, which is consistent with attacker-controlled data theft and covert reporting. The attacker model is a malicious PyPI package publisher using a deceptive test-like name (`rce-test`) and minimal metadata to harvest basic host information on install. The OSV advisory and static findings both corroborate the same behavior, but the code itself is already conclusive. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Sensitive File Access in setup.py: ""/etc/passwd"" - OAST/Interactsh Exfiltration in setup.py: "webhook.site" - Python File Upload to Remote in setup.py: "urllib.request.Request(webhook_url, data=" - Network Request in setup.py: "requests.post(" ADDITIONAL FINDINGS - Shell Command Execution in setup.py: "subprocess.check_output(" - Silent Process Execution in setup.py: "stderr=subprocess.DEVNULL" - Setup.py Command Override in setup.py: "cmdclass={"install"" PAYLOAD FILES setup.py