GCVE-110-OSM-2026-3515

[osmalyze-auto] Malicious package detected. Behaviors: data exfiltration, code execution. [osmalyze-auto] Entrypoint: setup.py (install-hook: install/develop/build override present) Exfil: 8401249501:AAEBrzEM4yGzgZFlOBxsEI_uDvkNlBNL9Dk (telegram-bot, recovery: plaintext in setup.py) Payload: setup.py Key findings: - Shell Command Execution in setup.py: "subprocess.Popen(" - System Information Exfiltration in setup.py: "socket.gethostname()} | IP: {requests.get('https://api.ipify.org').text} | Управ..." - HTTP Data Exfiltration in setup.py: "socket.gethostname()} | IP: {requests.get('https://api.ipify.org').text} | Управ..." - setup.py Code Execution in setup.py: "class CustomInstall(install): def run(self): install.run(self) ..." - Setup.py Command Override in setup.py: "cmdclass={'install'" IOCs: - telegramBots: 8401249501:AAEBrzEM4yGzgZFlOBxsEI_uDvkNlBNL9Dk - payloadFileHash: bf3078261cda65578f2f26093a346faa19b4e078d30a41849abc0d2c3597dbdf