GCVE-110-OSM-2026-11258

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation. Judge assessment: This looks like a dependency-confusion style beacon rather than a normal library: `setup.py` runs `_beacon("install")` during installation, builds a hostname from `socket.gethostname()`, `getpass.getuser()`, and `platform.python_version()`, then performs both `socket.getaddrinfo()` and `urllib.request.urlopen()` to the OAST host `i4nqdngoap6qxdae6oisidtlscy4m6av.oastify.com`. The package’s own prose claims it is a “security-research canary” and “responsible disclosure,” which is a plausible pentest explanation, but the code still exfiltrates host identifiers on install and first import with no functional purpose. Because the attacker model is ambiguous between a canary test and a malicious install-time tracker, I would not call it benign, but the evidence does not support confidently labeling it outright malicious given the explicit research framing. DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in setup.py: "oastify.com" - OAST/Interactsh Exfiltration in src/flyteplugins/nsight/__init__.py: "oastify.com" - System Information Exfiltration in setup.py: "socket.gethostname(), 30), "u-" + _san(getpass.getuser(), 16), "py-" + _san(plat..." - System Information Exfiltration in src/flyteplugins/nsight/__init__.py: "socket.gethostname(), 30), "u-" + _san(getpass.getuser(), 16), "py-" + _san(plat..." - Network Request in setup.py: "urllib.request.urlopen(" - System Information Collection in setup.py: "socket.gethostname()" - DNS Lookup in setup.py: "socket.getaddrinfo(" - Suspicious Domain in setup.py: "oastify.com" (+4 more) PAYLOAD FILES setup.py (+ src/flyteplugins/nsight/__init__.py)