GCVE-110-OSM-2026-13233

The package fires a canarytokens.com beacon on every import via `_canary()`, collecting Docker/K8s/CI environment boolean flags, parent process name, install path prefix, and a random UUID — then exfiltrating as a URL-encoded JSON GET to a hardcoded canarytokens.com endpoint. The code explicitly self-labels this as an 'authorized-security-assessment canary' and provides an opt-out env var (`ECHOGEN_NO_CANARY=1`), strongly consistent with a supply-chain research or dependency-confusion probe rather than a weaponized stealer.