GCVE-110-OSM-2026-11044

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation. Judge assessment: This is a classic install-hook credential/data-theft package: `setup.py` overrides `install` via `cmdclass={"install": CustomInstall}` and immediately runs `subprocess.check_output(["cat", "/etc/passwd"])` before POSTing the result to a hardcoded `webhook.site` endpoint. The attacker model is a supply-chain thief abusing PyPI installation to exfiltrate host information to an OAST/custom-C2 sink, and the implementation matches that goal exactly with `requests.post()` / `urllib.request.urlopen()` fallback logic. The OSV advisory is corroborated by the actual code, not merely the metadata, and the `stderr=subprocess.DEVNULL` plus exception swallowing indicates deliberate concealment rather than benign build behavior. This package should be treated as confirmed malicious and submitted for response action. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Sensitive File Access in setup.py: ""/etc/passwd"" - OAST/Interactsh Exfiltration in setup.py: "webhook.site" - Python File Upload to Remote in setup.py: "urllib.request.Request(webhook_url, data=" - Network Request in setup.py: "requests.post(" ADDITIONAL FINDINGS - Shell Command Execution in setup.py: "subprocess.check_output(" - Silent Process Execution in setup.py: "stderr=subprocess.DEVNULL" - Setup.py Command Override in setup.py: "cmdclass={"install"" PAYLOAD FILES setup.py