GCVE-110-OSM-2026-14112

The OpenSSF Package Analysis project identified 'vinted-mocked-apis' @ 99.0.0 (pypi) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in src/vinted_mocked_apis/beacon.py: "oastify.com" - Network Request in src/vinted_mocked_apis/beacon.py: "urllib.request.Request(" - System Information Collection in src/vinted_mocked_apis/beacon.py: "socket.gethostname()" - DNS Lookup in src/vinted_mocked_apis/beacon.py: "socket.getaddrinfo(" - Suspicious Domain in src/vinted_mocked_apis/beacon.py: "oastify.com" ADDITIONAL FINDINGS - Setup.py Command Override in setup.py: "cmdclass={ "install": _Install, "develop": _Develop, "egg_info"" PAYLOAD FILES src/vinted_mocked_apis/beacon.py