GCVE-110-OSM-2026-11687

During import, the package collects sensitive information and exfiltrates it using DNS queries. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-ekx-report-utils Reasons (based on the campaign): - targetted-attack - exfiltration-generic - exfiltration-credentials Judge assessment: This looks like an infostealer-style package intended to collect environment data at import time and exfiltrate it, matching the attacker model described in MAL-2026-14555. The code in `src/ekx_report_utils/__init__.py` reads `SANDBOX_ROUTER_URL` from `os.environ` and then uses `urllib.request.Request`, `urllib.request.urlopen`, and `socket.getaddrinfo`, which is consistent with sensitive-data collection plus network-based exfiltration. The minimal metadata (`missing-description`, `no-repository`, `metadata-minimal`) also fits a throwaway malicious package rather than a normal utility library. I would treat this as a targeted malicious package and submit it for OSM with critical/malicious severity. EXFIL - Environment Variable Exfiltration in src/ekx_report_utils/__init__.py: "os.environ.get("SANDBOX_ROUTER_URL", "") if not c or not r: return import urllib" - Network Request in src/ekx_report_utils/__init__.py: "urllib.request.Request(" - DNS Lookup in src/ekx_report_utils/__init__.py: "socket.getaddrinfo(" PAYLOAD FILES src/ekx_report_utils/__init__.py