GCVE-110-OSM-2026-14111

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution. ENTRY src/test_workalendar_internal/__main__.py (console-script: test-workalendar-internal=test_workalendar_internal.__main__:main) DESTINATION - 3 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in hatch_build.py: "webhook.site" - Python File Upload to Remote in hatch_build.py: "urllib.request.Request( webhook_url, data=" - Data Encoding for Exfiltration in hatch_build.py: "json.dumps(result).encode" - Network Request in hatch_build.py: "urllib.request.Request(" ADDITIONAL FINDINGS - Shell Command Execution in hatch_build.py: "subprocess.Popen(" - Silent Process Execution in hatch_build.py: "stdout=subprocess.DEVNULL" - Brand New Package - Rapid Version Publishing PAYLOAD FILES hatch_build.py