GCVE-110-OSM-2026-12874

During import, the code exfiltrates potentially sensitive env variables. In all analyzed versions the exfiltration target was a localhost, suggesting it was just a test. Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: 2026-09-0requests Reasons (based on the campaign): - exfiltration-env-variables - typosquatting Judge assessment: This looks like a typosquatted package (`py-2equests`) with burner-style metadata and a console entrypoint that self-identifies as targeting requests, which is unusual and worth scrutiny. The only code execution finding is `subprocess.Popen(` in `py_2equests/__init__.py`, but the provided entrypoint content does not show any actual payload, and there are no recovered IOCs or exfil artifacts to confirm harmful behavior. The OSV advisory claims env-variable exfiltration, yet the evidence here does not include the described exfil path or any concrete network target, so I cannot escalate to malicious on this payload alone. The most plausible attacker model is a lightweight dependency-confusion or typosquat test package that may become a delivery vector, but the current static evidence is insufficient for a definitive malicious verdict. ENTRY py_2equests/cli.py (console-script: 'py_2equests=py_2equests.cli:main') ADDITIONAL FINDINGS - Shell Command Execution in py_2equests/__init__.py: "subprocess.Popen(" PAYLOAD FILES py_2equests/__init__.py