GCVE-110-OSM-2026-192

Malicious package detected. Behaviors: data exfiltration, network activity. Payload: setup.py Key findings: - Environment Variable Exfiltration in setup.py: "os.environ.get("USER") or os.environ.get("USERNAME") or os.environ.get("LOGNAME"..." - System Information Exfiltration in setup.py: "os.getcwd(), } try: d["public_ip"] = urllib.request...." - Python File Upload to Remote in setup.py: "urllib.request.Request( "http://69.164.221.216:8080/callback", ..." - HTTP Data Exfiltration in setup.py: "os.getcwd(), } try: d["public_ip"] = urllib" - IP Lookup Service in setup.py: "ipify.org" IOCs: - ipv4: 69.164.221.216 - urls: http://69.164.221.216:8080/callback - payloadFileHash: 67f64b92319e7c2dc37b1d571ab0cfbf36fadee5254371b0d8628728968a6a58