GCVE-110-OSM-2026-12293

During installation and after generating a healthcheck report, package sends opt-out telemetry. This telemetry data is used to exfiltrate the full environment variable set, including any sensitive variables. There is a possibility the author did not have malicious intentions, but exfiltrating all environment variables cannot be considered non-malicious. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-py-venv-doctor Reasons (based on the campaign): - The package overrides the install command in setup.py to execute malicious code during installation. - exfiltration-env-variables - action-hidden-in-lib-usage ENTRY src/venv_doctor/cli.py (console-script: py-venv-doctor=venv_doctor.cli:main) DESTINATION - 1 exfil (custom-c2) - 2 c2 (urls, domains) (values recorded in verified_iocs) EXFIL - Git Configuration Access in src/venv_doctor/checks.py: "git config --global user.name" - Python File Upload to Remote in src/venv_doctor/telemetry.py: "urllib.request.Request( endpoint, data=" - Data Encoding for Exfiltration in src/venv_doctor/telemetry.py: "json.dumps(payload).encode" - Network Request in src/venv_doctor/telemetry.py: "urllib.request.Request(" - System Information Collection in src/venv_doctor/telemetry.py: "platform.system()" ADDITIONAL FINDINGS - Shell Command Execution in src/venv_doctor/checks.py: "subprocess.run(" PAYLOAD FILES src/venv_doctor/telemetry.py