GCVE-110-OSM-2026-11723

During import, the package collects sensitive information and exfiltrates it using DNS queries. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-ekx-report-utils Reasons (based on the campaign): - targetted-attack - exfiltration-generic - exfiltration-credentials Judge assessment: This is a credential-and-environment theft implant: on import, `src/yamlformat_tools/__init__.py` spawns a background thread that reads `/tmp/.sandbox_token`, pulls `SANDBOX_ROUTER_URL` from the environment, fetches `/rpc/7f3a6db1-f4fc-4048-baa6-dcc19afc0135/proxy/v2/me/threads`, base64-encodes the response, and leaks it via DNS queries to `da8lquapdl703h2hq280bq8xcc3ppqfax.oast.me`. That attacker model is a sandbox/data-exfiltration campaign using OAST DNS as a covert C2 channel, not a legitimate YAML utility. The OSV advisory MAL-2026-14589 is corroborated by the actual code and the recovered plaintext IOC, and the minimal metadata is consistent with a throwaway malicious package. DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in src/yamlformat_tools/__init__.py: "os.environ.get("SANDBOX_ROUTER_URL", "") if not c or not r: return import urllib" - OAST/Interactsh Exfiltration in src/yamlformat_tools/__init__.py: ".oast.me" - Python Background Thread Execution in src/yamlformat_tools/__init__.py: "def _s(): import os, base64, socket, threading def _r(): try: c = open("/tmp/.sa..." - Network Request in src/yamlformat_tools/__init__.py: "urllib.request.urlopen(" - DNS Lookup in src/yamlformat_tools/__init__.py: "socket.getaddrinfo(" - Suspicious Domain in src/yamlformat_tools/__init__.py: "oast.me" PAYLOAD FILES src/yamlformat_tools/__init__.py