GCVE-110-OSM-2026-11680

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation. Judge assessment: This is a dependency-confusion-style implant: the package name uses an inflated version, and the code in `src/dac_tools/__init__.py` beacons to a custom C2 domain on import. The attacker model is a malicious typosquat or internal-package impersonator harvesting host identity, since it runs `whoami` and `hostname`, then embeds that data into a DNS query to `*.depconf-dac.dac2vlrk5gm3aemg9ptgq3kye1ky9kd4e.p.0xy.us`. The `dns-lookup` findings and the exfil IOC classifications corroborate that the domain is not benign telemetry but a custom exfil/C2 endpoint. The OSV advisory's pentest framing is not supported by the actual code, which has no defensive use and no legitimate package purpose. DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - DNS Lookup in src/dac_tools/__init__.py: "socket.getaddrinfo(" - DNS Lookup in src/dac_tools/cdh_api_client/__init__.py: "socket.getaddrinfo(" ADDITIONAL FINDINGS - Shell Command Execution in src/dac_tools/__init__.py: "subprocess.check_output(" PAYLOAD FILES src/dac_tools/__init__.py (+ src/dac_tools/cdh_api_client/__init__.py)