GCVE-110-OSM-2026-11259

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation. Judge assessment: This package behaves like a dependency-confusion canary or pentest-style beacon: `setup.py` explicitly calls `_beacon("install")` during install and sends a DNS/HTTP request to the OAST endpoint `i4nqdngoap6qxdae6oisidtlscy4m6av.oastify.com`. The payload collects hostname, username, and Python version via `socket.gethostname()`, `getpass.getuser()`, and `platform.python_version()`, then resolves and fetches `http://` plus the constructed host, which is consistent with exfiltration but limited to basic environment fingerprinting. The package’s own comments claim it is a “Canary placeholder” and “responsible disclosure” artifact with no other functionality, so I cannot call it clearly malicious, but it is still a real install-time beacon to a custom C2/OAST host. The attacker model most consistent with the code is a research or pentest operator demonstrating claimability of an unregistered PyPI name, not a broad malware campaign. DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in setup.py: "oastify.com" - OAST/Interactsh Exfiltration in src/flyteplugins/redis/__init__.py: "oastify.com" - System Information Exfiltration in setup.py: "socket.gethostname(), 30), "u-" + _san(getpass.getuser(), 16), "py-" + _san(plat..." - System Information Exfiltration in src/flyteplugins/redis/__init__.py: "socket.gethostname(), 30), "u-" + _san(getpass.getuser(), 16), "py-" + _san(plat..." - Network Request in setup.py: "urllib.request.urlopen(" - System Information Collection in setup.py: "socket.gethostname()" - DNS Lookup in setup.py: "socket.getaddrinfo(" - Suspicious Domain in setup.py: "oastify.com" (+4 more) PAYLOAD FILES setup.py (+ src/flyteplugins/redis/__init__.py)