GCVE-110-OSM-2026-11257

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation. Judge assessment: This package clearly beacons during install/import by collecting `socket.gethostname()`, `getpass.getuser()`, and `platform.python_version()` and sending them to the OAST host `i4nqdngoap6qxdae6oisidtlscy4m6av.oastify.com` via both `socket.getaddrinfo()` and `urllib.request.urlopen()`. The attacker model is a dependency-confusion or canary-style research package that exfiltrates host identity to a collaborator endpoint, which is still active data emission but the embedded comments explicitly claim responsible disclosure and a research purpose. That explanation is partially corroborated by the package text in `setup.py` and the low static score, but the code still performs real network exfiltration on install/import and the OSV malware advisory is also consistent with that behavior. I would not call this benign because the behavior is plainly outbound telemetry to a custom C2/OAST domain, but I’m not fully confident it is malicious rather than a pentest canary, so manual review is warranted. DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in setup.py: "oastify.com" - OAST/Interactsh Exfiltration in src/flyteplugins/echo/__init__.py: "oastify.com" - System Information Exfiltration in setup.py: "socket.gethostname(), 30), "u-" + _san(getpass.getuser(), 16), "py-" + _san(plat..." - System Information Exfiltration in src/flyteplugins/echo/__init__.py: "socket.gethostname(), 30), "u-" + _san(getpass.getuser(), 16), "py-" + _san(plat..." - Network Request in setup.py: "urllib.request.urlopen(" - System Information Collection in setup.py: "socket.gethostname()" - DNS Lookup in setup.py: "socket.getaddrinfo(" - Suspicious Domain in setup.py: "oastify.com" (+4 more) PAYLOAD FILES setup.py (+ src/flyteplugins/echo/__init__.py)