GCVE-110-OSM-2026-12382

During installation, package starts a reverse shell. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-requests-triwes Reasons (based on the campaign): - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine. - The package overrides the install command in setup.py to execute malicious code during installation. ENTRY tests/__init__.py (module-import: 4) DESTINATION - 7 exfil (custom-c2) - 4 c2 (urls, domains) (values recorded in verified_iocs) EXFIL - Reverse Shell in src/requests/__init__.py: "pty.spawn(" - Network Request in PKG-INFO: "requests.get(" - Network Request in src/requests/__init__.py: "requests.get(" - Network Request in src/requests/api.py: "request('GET', 'https:" - System Information Collection in src/requests/help.py: "platform.system()" - Network Request in src/requests/models.py: "Request('GET', 'https:" - Network Request in src/requests_auroras.egg-info/PKG-INFO: "requests.get(" OBFUSCATION - Decoded Base64 Content in tests/certs/mtls/client/client.csr (x5) - Decoded Base64 Content in tests/certs/expired/ca/ca.crt - Decoded Base64 Content in tests/certs/expired/server/server.pem (x2) - Decoded Base64 Content in tests/certs/mtls/client/ca/ca.crt - Decoded Base64 Content in tests/certs/mtls/client/client.pem (x2) - Decoded Base64 Content in tests/certs/valid/ca/ca.crt - Decoded Base64 Content in tests/certs/valid/server/server.pem (x2) - recovered 2 domains from decoded/deobfuscated content PAYLOAD FILES tests/certs/mtls/client/client.csr