GCVE-110-OSM-2026-13942

get-report 0.5.1 is a highly invasive host-security scanner, but the reviewed source does not contain a confirmed credential-exfiltration or payload-download mechanism. We would classify it as suspicious / high privacy risk, not confirmed malware. This package inventories credentials, browser sessions, processes, cloud configuration, Docker, SSH, scheduled tasks, network services, and LAN hosts. Every module—including active LAN probing, Internet connectivity testing, and Chrome session inspection—is enabled by default. The parsed --yes-lan consent flag is never enforced. ENTRY src/get_report/cli.py (console-script: get-report=get_report.cli:main) LOOT - Browser Data Theft in src/get_report/config.py: "AppData/Local/Microsoft" - Browser Data Theft in src/get_report/scanner/chrome.py: "Chrome/{profile.dir_name}/Cookies" PERSISTENCE - Startup Persistence in src/get_report/model.py: ".profile" - Startup Persistence in src/get_report/report/executive_report.py: ".profile" - Startup Persistence in src/get_report/report/html_report.py: ".profile" - Startup Persistence in src/get_report/report/json_report.py: ".profile" - Startup Persistence in src/get_report/scanner/chrome.py: ".profile" DESTINATION - 16 exfil (custom-c2, awsAccessKeys) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in src/get_report/report/executive_report.py: "webhook.site" - OAST/Interactsh Exfiltration in src/get_report/scanner/internet.py: "Webhook.site" - Payload Download from Paste Service in src/get_report/report/executive_report.py: "pastebin.com" - Data Encoding for Exfiltration in src/get_report/report/executive_report.py: "base64.b64encode(" - Git Configuration Access in src/get_report/report/executive_report.py: ".git/config" - Data Encoding for Exfiltration in src/get_report/report/html_report.py: "base64.b64encode(" - Data Encoding for Exfiltration in src/get_report/report/json_report.py: "base64.b64encode(" - Git Configuration Access in src/get_report/scanner/filesystem.py: ".gitconfig" (+11 more) ADDITIONAL FINDINGS - Chai-Max Browser Data Theft in src/get_report/report/executive_report.py: "chrome and meta.chrome and meta.chrome.profiles: total_cookies = sum(len(p.cooki..." - Ngrok Tunneling Service in src/get_report/report/executive_report.py: "ngrok.com" - Shell Command Execution in src/get_report/scanner/chrome.py: "subprocess.Popen(" - Silent Process Execution in src/get_report/scanner/chrome.py: "stdout=subprocess.DEVNULL" - Brand New Package PAYLOAD FILES src/get_report/report/executive_report.py (+ src/get_report/scanner/chrome.py, src/get_report/scanner/internet.py)