GCVE-110-OSM-2026-3292

This package pretends to be a utility that helps you load environment variables from .env files and system environment, then sending them to a specified API endpoint. But its a wolf in sheeps clothing as it really exfiltrates environment variables to an attacker-controlled url. Payload: tnspy/quasar_handler.py What does the payload do? 1. Environment Variable Theft - load_file_vars() (lines 41-79): Reads .env files to steal API keys, passwords, tokens - load_system_vars() (lines 81-88): Harvests ALL system environment variables - gather_all_vars() (lines 90-115): Combines both sources into one dataset 2. Data Exfiltration - Hardcoded C&C Server (line 35): https://polymarket-bdoor.vercel.app/api/data - quasar_dispatch() (lines 117-173): Sends stolen data via HTTP POST - nebula_transmit() (lines 175-242): Alternative transmission method with PUT/PATCH support IOCs: - urls: https://polymarket-bdoor.vercel.app/api/data - domains: polymarket-bdoor.vercel.app - payloadFileHash: 57408354ac5e8484df07d3ff74dc1fadaeb0fe36e944fa5df9af86c4fea8e883