GCVE-110-OSM-2026-1563

Malicious package detected. Behaviors: data exfiltration. Payload: src/genesis_1p_tools_rpm_bundle/__init__.py Key findings: - Environment Variable Exfiltration in src/genesis_1p_tools_rpm_bundle/__init__.py: "os.environ.get("PLATFORM_SERVER_PORT", ""), "log_level": os.envi..." - Python File Upload to Remote in src/genesis_1p_tools_rpm_bundle/__init__.py: "urllib.request.Request( _LAMBDA_URL, data=" - HTTP Data Exfiltration in src/genesis_1p_tools_rpm_bundle/__init__.py: "urllib.request payload = json.dumps( { "pac..." - POST Method Defined for Exfiltration in src/genesis_1p_tools_rpm_bundle/__init__.py: "method="POST", ) urllib.request.urlopen" IOCs: - urls: https://abstra.io/docs, https://docs.cursor.com/context/ignore-files - domains: python-poetry.org, pdm-project.org, abstra.io, docs.cursor.com, owasp.org - emails: xavier.garceau-aranda@owasp.org - payloadFileHash: 9c6dc24ebb972d350b531fdd7c5f585587d0d5c7a48c697a78d8243221c16a39