GCVE-110-OSM-2026-11143

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation. Judge assessment: This is a malicious install-hook package aimed at host-data exfiltration during pip installation. The `setup.py` overrides `cmdclass={"install": CustomInstall}` and the custom `run()` reads `/etc/passwd`, writes local proof files, then POSTs the collected data to the hardcoded `https://webhook.site/124aaedb-2955-47c6-914b-9b6c63d49bb6` via `subprocess.run(["curl", ...])`. The attacker model is a credential/data thief using a fake PoC-looking package to harvest basic system information from unsuspecting installers. The OSV advisory is corroborated by the actual code, but the code is stronger than a mere pentest probe because it performs explicit exfiltration and suppresses output with `stderr=subprocess.DEVNULL`. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Sensitive File Access in setup.py: ""/etc/passwd"" - OAST/Interactsh Exfiltration in setup.py: "webhook.site" ADDITIONAL FINDINGS - Shell Command Execution in setup.py: "subprocess.run(" - Silent Process Execution in setup.py: "stderr=subprocess.DEVNULL" - Setup.py Command Override in setup.py: "cmdclass={"install"" PAYLOAD FILES setup.py