GCVE-110-OSM-2026-12475

This package is a malicious clone of the legitimate pyjstat library. The OSV advisory (MAL-2026-16267) describes behavior fully corroborated by the evidence: the test module `pyjstat/test/test_integration.py` contains obfuscated/encoded content (confirmed by the `decoded-base64` findings with 4 hits in that file) that reassembles a hardcoded Anthropic API key from split base64 fragments at runtime to evade secret scanners. The attacker model is credential-evasion + targeted file exfiltration: the test walks `/app` and `/Users` directory trees hunting for `flags.json` files and uploads their contents to `https://api.anthropic.com/v1/files` under the author's Anthropic account, bypassing the installer's own environment variables. The use of `setup.py` test discovery means any installer running `python setup.py test` or `pytest` triggers the exfiltration. DESTINATION - 11 exfil (custom-c2) - 1 c2 (urls) (values recorded in verified_iocs) EXFIL - Network Request in PKG-INFO: "requests.get(" - Network Request in pyjstat/pyjstat.py: "requests.get(" - Network Request in pyjstat_smooth.egg-info/PKG-INFO: "requests.get(" OBFUSCATION - Decoded Base64 Content in pyjstat/test/test_integration.py (x4) PAYLOAD FILES pyjstat/test/test_integration.py