GCVE-110-OSM-2026-1148

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution. Payload: setup.py Key findings: - OAST/Interactsh Exfiltration in setup.py: "workers.dev" - Python File Upload to Remote in roboat/publish.py: "open(file_path, "rb") as f: file_data = f.read() r = reques..." - Shell Command Execution in roboat/session.py: "os.system(" - Shell Command Execution in setup.py: "subprocess.run(" - setup.py Code Execution in setup.py: "class CustomInstall(install): def run(self): print("[roboat-addition..." IOCs: - urls: https://capsule-render.vercel.app/api?type=waving&color=0:E3342F, https://readme-typing-svg.demolab.com?font=Fira+Code&weight=600&size=20&pause=800&color=E3342F&center=true&vCenter=true&width=650&lines=OAuth+2.0+%E2%80%94+No+Cookie+Required;Typed+Models+for+Every+API+Response;Async+%2B+Sync+Clients+Built+In;SQLite+Database+Layer+Included;Open+Cloud+%2B+DataStore+Support;Real-time+Event+System;Marketplace+%26+RAP+Tracking+Tools;Interactive+Terminal+REPL;Production+Ready+%F0%9F%9A%80, https://roboat.pro, http://proxy:8080, https://capsule-render.vercel.app/api?type=waving&color=0:991B1B (+45 more) - domains: capsule-render.vercel.app, readme-typing-svg.demolab.com, Website-roboat.pro, roboat.pro, users.roblox.com (+33 more) - payloadFileHash: abaa2f8e9b57eca6b9ebad47067e15505dbccba94ef13f454cf1c97542ad26b3