GCVE-110-OSM-2026-13327

This is a self-declared dependency confusion proof-of-concept by Cylent Security, authorized for Ledger, as stated explicitly in the setup.py docstring and payload fields. The code collects hostname, username, IP, CWD, platform info, and CI/GitHub environment variables, then POSTs them to a webhook.site endpoint — classic canary token behavior consistent with authorized red team exercises. The OSV advisory categorizes this as PROBABLY_PENTEST with GENERIC-standard-pypi-install-pentest, which aligns with the code's self-description. However, osmalyze cannot independently verify the authorization claim, the package is published publicly on PyPI at an obviously inflated version (99.0.0), and the collection of JFROG_USER/JFROG_DOMAIN and GitHub Actions secrets suggests CI pipeline targeting. This warrants a suspicious verdict pending confirmation of authorization scope rather than a full malicious flag. DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in setup.py: "webhook.site" - System Information Collection in setup.py: "socket.gethostname()" - DNS Lookup in setup.py: "socket.gethostbyname(" PAYLOAD FILES setup.py