GCVE-110-OSM-2026-2693

Malicious package detected. Behaviors: data exfiltration. Payload: setup.py Secondary files: shan_lib/__init__.py Key findings: - Python File Upload to Remote in setup.py: "urllib.request.Request( _CALLBACK_HTTP, data=" - System Information Exfiltration in setup.py: "socket.gethostname() label = "".join(c if c.isalnum() or c == "-" else "-" for c..." - Data Encoding for Exfiltration in setup.py: "json.dumps({"h": host, "t": ts, "v": "1.0", "e": "install", "pkg": "shan-lib-poc..." - Python File Upload to Remote in shan_lib/__init__.py: "urllib.request.Request( _CALLBACK_HTTP, data=" - Data Encoding for Exfiltration in shan_lib/__init__.py: "json.dumps({"h": host, "t": ts, "v": __version__}).encode" IOCs: - urls: https://oast.nextroot.io/callback, https://myorg.okta.com``., https://{self.account - domains: euronext.com, oast.nextroot.io - emails: shan-digital@euronext.com - payloadFileHash: 7c5041c04725acd23c9b0ae3d2205566a7f8f43581e1322dcd1abc0ca5f07638