GCVE-110-OSM-2026-12863

The package automatically joins the machine to a proxy network. Depending on the version, it can happen during the package installation or when importing the module. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-prosocks Reasons (based on the campaign): - other - peristence-autorun - persistence ENTRY prosocks/main.py (console-script: 'prosocks=prosocks.main:main') EXFIL - System Information Exfiltration in prosocks/main.py: "socket.gethostname() for url in ['http://ip-api.com/json/', 'https://api.ipify.o..." - HTTP Data Exfiltration in prosocks/main.py: "socket.gethostname() for url in ['http://ip-api.com/json/', 'https://api.ipify.o..." - System Information Exfiltration in prosocks.py: "socket.gethostname() for url in ['http://ip-api.com/json/', 'https://api.ipify.o..." - HTTP Data Exfiltration in prosocks.py: "socket.gethostname() for url in ['http://ip-api.com/json/', 'https://api.ipify.o..." - Python Background Thread Execution in prosocks/main.py: "threading.Thread(target=self._send_bandwidth_updates, daemon=True).start() threa..." - Network Request in prosocks/main.py: "requests.get(" - System Information Collection in prosocks/main.py: "socket.gethostname()" - Python Background Thread Execution in prosocks.py: "threading.Thread(target=self._test_and_send_bandwidth, daemon=True).start() logg..." (+2 more) ADDITIONAL FINDINGS - Shell Command Execution in prosocks/__init__.py: "subprocess.Popen(" - Silent Process Execution in prosocks/__init__.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES prosocks/main.py (+ prosocks.py)