GCVE-110-OSM-2026-11261

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation. Judge assessment: This package is a straightforward host-data exfiltration implant: importing `mathkitlite/__init__.py` immediately calls `_report()`, which sends `getpass.getuser()` and `socket.gethostname()` to a hardcoded OAST endpoint. The attacker model is a dependency-confusion or supply-chain loader meant to beacon basic victim identity to `s10rbz1zv65voeqak7u5sixz8tslkghnm.oast.fun/collect`, and the same behavior is duplicated in `setup.py`, showing intent to run both on install and import. The combination of `oast-exfiltration`, `python-file-upload`, `system-info-exfil`, and `http-exfiltration` is not a plausible math library behavior; the package has no legitimate purpose beyond beaconing. The OSV advisory’s claim is corroborated by the actual code, even though the sample shown here is enough on its own to confirm malicious exfiltration. ENTRY mathkitlite/__init__.py (module-import: 23) DESTINATION - 2 exfil (oast, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in mathkitlite/__init__.py: ".oast.fun" - OAST/Interactsh Exfiltration in setup.py: ".oast.fun" - Python File Upload to Remote in mathkitlite/__init__.py: "urllib.request.Request( _ENDPOINT, data=" - System Information Exfiltration in mathkitlite/__init__.py: "socket.gethostname()} ).encode() req = urllib.request.Request( _ENDPOINT, data=p..." - HTTP Data Exfiltration in mathkitlite/__init__.py: "getpass.getuser(), "host": socket.gethostname()} ).encode() req = urllib" - Python File Upload to Remote in setup.py: "urllib.request.Request( _ENDPOINT, data=" - System Information Exfiltration in setup.py: "socket.gethostname()} ).encode() req = urllib.request.Request( _ENDPOINT, data=p..." - HTTP Data Exfiltration in setup.py: "getpass.getuser(), "host": socket.gethostname()} ).encode() req = urllib" (+6 more) PAYLOAD FILES mathkitlite/__init__.py (+ setup.py)