GCVE-110-OSM-2026-1193

Advisory PublishedCVSS 5.4/10

Vulnetix · Advisory published March 31, 2026

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity. Payload: setup.py Key findings: - System Information Exfiltration in setup.py: "socket.gethostname() cwd = os.getcwd() username = getpass.getu..." - OAST/Interactsh Exfiltration in setup.py: ".oast.fun" - HTTP Data Exfiltration in setup.py: "socket.gethostname() cwd = os.getcwd() username = getpass.getu..." - Suspicious Domain in setup.py: "oast.fun" - setup.py Code Execution in setup.py: "cmdclass={'install'" IOCs: - urls: https://zttjbwgtirpuvcurmyjzdaxlhtd51ex4b.oast.fun - domains: zttjbwgtirpuvcurmyjzdaxlhtd51ex4b.oast.fun, burpcollaborator.net - oastEndpoints: https://zttjbwgtirpuvcurmyjzdaxlhtd51ex4b.oast.fun - payloadFileHash: 416b1acd8e8081d03bed1082176260ee841118fcebd94a6df297885b42488d4f

Download JSON Open in Console