GCVE-110-OSM-2026-3222

Malicious package detected. Behaviors: data exfiltration, code execution. Payload: elementary/monitor/alerts/alert_messages/builder.py Secondary files: elementary/monitor/alerts/alerts_groups/alerts_group.py, elementary/monitor/data_monitoring/alerts/data_monitoring_alerts.py Key findings: - Corporate Environment Targeting in elementary/monitor/alerts/alert_messages/builder.py: "tModel from elementary.monitor.alerts.test_alert import Test" - Corporate Environment Targeting in elementary/monitor/alerts/alerts_groups/alerts_group.py: "tModel class AlertsGroup(BaseAlertsGroup): test_errors: List[AlertModel] ..." - Corporate Environment Targeting in elementary/monitor/data_monitoring/alerts/data_monitoring_alerts.py: "tModel from elementary.monitor.alerts.test_alert import Test" - Corporate Environment Targeting in elementary/monitor/data_monitoring/alerts/integrations/base_integration.py: "tModel from elementary.monitor.alerts.test_alert import Test" - Corporate Environment Targeting in elementary/monitor/data_monitoring/alerts/integrations/slack/slack.py: "tModel from elementary.monitor.alerts.test_alert import Test" IOCs: - urls: http://www.apache.org/licenses/, http://www.apache.org/licenses/LICENSE-2.0, https://docs.elementary-data.com, https://www.elementary-data.com, https://docs.elementary-data.com/oss/quickstart/quickstart-cli-package (+14 more) - domains: www.apache.org, res.cloudinary.com, static.pepy.tech, click.Group, bit.ly (+7 more) - payloadFileHash: 593af031f31c8cf90711f67736f125a7095d6c6dd3d02de00108993111f1720f