GCVE-110-OSM-2026-1564

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution. Payload: setup.py Key findings: - OAST/Interactsh Exfiltration in setup.py: "workers.dev" - Shell Command Execution in setup.py: "subprocess.run(" - setup.py Code Execution in setup.py: "class CustomInstall(install): def run(self): print("[roboat-updater]..." - Setup.py Command Override in setup.py: "cmdclass={'install'" IOCs: - urls: https://capsule-render.vercel.app/api?type=waving&color=0:E3342F, https://readme-typing-svg.demolab.com?font=Fira+Code&weight=600&size=20&pause=800&color=E3342F&center=true&vCenter=true&width=650&lines=OAuth+2.0+%E2%80%94+No+Cookie+Required;Typed+Models+for+Every+API+Response;Async+%2B+Sync+Clients+Built+In;SQLite+Database+Layer+Included;Open+Cloud+%2B+DataStore+Support;Real-time+Event+System;Marketplace+%26+RAP+Tracking+Tools;Interactive+Terminal+REPL;Production+Ready+%F0%9F%9A%80, https://roboat.pro, http://proxy:8080, https://capsule-render.vercel.app/api?type=waving&color=0:991B1B (+1 more) - domains: capsule-render.vercel.app, readme-typing-svg.demolab.com, Website-roboat.pro, roboat.pro, role.id (+4 more) - payloadFileHash: eb93deca80e6cb89584c6a71ec6e391c048a02565dd54fe3777e49cfc4598808