GCVE-110-OSM-2026-3156

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, network activity, obfuscated code. Payload: engine/payloads.py Key findings: - OAST/Interactsh Exfiltration in engine/payloads.py: "burpcollaborator.net" - Dynamic Code Execution in engine/payloads.py: "exec(cmd)" - Shell Command Execution in engine/payloads.py: "child_process').exec" - Git Configuration Access in engine/payloads.py: ".git/config" IOCs: - ipv4: 100.100.100.200 - ipv6: 0000:: - urls: https://evil-attacker.com, http://169.254.169.254/latest/meta-data/, http://evil.com/xxe.dtd, http://evil.com/?%data;\, http://169.254.169.254/latest/meta-data/iam/security-credentials/ (+8 more) - domains: asp.net, localtest.me, spoofed.burpcollaborator.net - bitcoinAddresses: 11111111111111111111111111111111, 1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa, bc1qw508d6qejxtdg4y5r3zarvary0c5xw7kv8f3t4, 3J98t1WpEZ73CNmQviecrnyiWrnqRhWNLy - ethereumAddresses: 0x0000000000000000000000000000000000000000, 0x0000000000000000000000000000000000000001, 0xdead000000000000000000000000000000000000, 0x000000000000000000000000000000000000dEaD, 0xdEaD000000000000000000000000000000000000 (+2 more) - oastEndpoints: http://spoofed.burpcollaborator.net/ - payloadFileHash: f2f235a1d80b3c7e8acfd5ac9c9774ff31013f5a0ada2dd09e64f35ff43a818d