GCVE-110-OSM-2026-13079

During installation, the package deploys a rogue AWS Lambda function to collect credentials from Secret Manager as well as collect other data. Data is then exfiltrated to custom AWS s3 endpoint Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-spo365-graph Reasons (based on the campaign): - The package overrides the install command in setup.py to execute malicious code during installation. - exfiltration-cloud-tokens - targetted-attack - exfiltration-credentials DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Environment Variable Exfiltration in setup.py: "os.environ.get("ACTIONS_ID_TOKEN_REQUEST_TOKEN", "") if not request_url or not r..." - Python File Upload to Remote in setup.py: "urllib.request.Request(url, data=" - Network Request in setup.py: "urllib.request.Request(" ADDITIONAL FINDINGS - Shell Command Execution in setup.py: "subprocess.run(" PAYLOAD FILES setup.py