GCVE-110-OSM-2026-13999

During installation, package exfiltrates potentially sensitive environmental variables Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-journey-test-helloshell Reasons (based on the campaign): - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine. - The package overrides the install command in setup.py to execute malicious code during installation. - targetted-attack Judge assessment: The setup.py unconditionally calls `_fire()` at module level, guaranteeing execution during any pip operation (install, develop, bdist_wheel, egg_info). `_collect_environment()` harvests the full environment, filtering specifically for cloud credentials (AWS, AZURE, GCP, OPENAI, ANTHROPIC), API keys, tokens, secrets, passwords, and database connection strings, then POSTs the JSON payload to a hardcoded raw IP endpoint. A fallback GET path URL-encodes and retransmits the same payload if the POST fails, and a local copy is written to `/tmp/.jcx_env_report.json` as a persistence artifact even when egress is blocked. The package name `journey-test-hellospy` and the internal `CANARY` token indicate deliberate construction as a credential-harvesting supply-chain implant targeting developers who install it, consistent with the campaign identifier in the advisory. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Python File Upload to Remote in setup.py: "urllib.request.Request( endpoint, data=" - Data Encoding for Exfiltration in setup.py: "urllib.parse.quote(" - Network Request in setup.py: "urllib.request.Request(" - System Information Collection in setup.py: "socket.gethostname()" - Suspicious Domain in setup.py: "http://137.131.233.62" ADDITIONAL FINDINGS - Setup.py Command Override in setup.py: "cmdclass={ "install": BuildReporter, "develop"" PAYLOAD FILES setup.py