GCVE-110-OSM-2026-12864

During installation, the package executes embeded malicious executable. It then fingerprints the environment and network, looks for specific files, attempts to collect cloud credentials, and eventually attempts to exfiltrate collected information. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-auclean Reasons (based on the campaign): - malware - network-scan - files-exfiltration - The package overrides the install command in setup.py to execute malicious code during installation. - exfiltration-credentials - exfiltration-cloud-tokens - targetted-attack ENTRY setup.py (install-hook: install/develop/build override present) ADDITIONAL FINDINGS - Shell Command Execution in auclean/_io.py: "subprocess.run(" PAYLOAD FILES auclean/_io.py (+ setup.py)