GCVE-110-OSM-2026-11686

During import, the package collects sensitive information and exfiltrates it using DNS queries. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-ekx-report-utils Reasons (based on the campaign): - targetted-attack - exfiltration-generic - exfiltration-credentials Judge assessment: This looks like an infostealer-style package for a targeted attacker model: on import it starts a background thread, reads `/tmp/.sandbox_token`, uses `SANDBOX_ROUTER_URL`, fetches `/proxy/v2/me/threads?limit=50&offset=0`, base64-encodes the response, and leaks it via DNS queries to `da8lfvqpdl7djb6ph55gpi6se811r4n3y.oast.fun`. The combination of `env-exfiltration`, `oast-exfiltration`, `python-threading-malware`, `network-request`, and `dns-lookup` is not a legitimate YAML formatter behavior and is consistent with covert data theft. The included MAL-2026-14590 advisory is corroborated by the actual `src/yamlformatter_utils/__init__.py` contents, which show the exfiltration path plainly in source. Metadata is intentionally minimal, further fitting a throwaway malicious package rather than a normal utility library. DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in src/yamlformatter_utils/__init__.py: "os.environ.get("SANDBOX_ROUTER_URL", "") if not c or not r: return import urllib" - OAST/Interactsh Exfiltration in src/yamlformatter_utils/__init__.py: ".oast.fun" - Python Background Thread Execution in src/yamlformatter_utils/__init__.py: "def _s(): import os, base64, socket, threading def _r(): try: c = open("/tmp/.sa..." - Network Request in src/yamlformatter_utils/__init__.py: "urllib.request.urlopen(" - DNS Lookup in src/yamlformatter_utils/__init__.py: "socket.getaddrinfo(" - Suspicious Domain in src/yamlformatter_utils/__init__.py: "oast.fun" PAYLOAD FILES src/yamlformatter_utils/__init__.py