GCVE-110-OSM-2026-4247

[osmalyze-auto] Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity. [osmalyze-auto] Entrypoint: stingxss/__main__.py (console-script: stingxss=stingxss.__main__:main) Exfil: https://xyz.oast.me (oast, recovery: plaintext in PKG-INFO) Payload: PKG-INFO Secondary files: stingxss/engine/analysis/payload_gen.py Key findings: - OAST/Interactsh Exfiltration in PKG-INFO: ".oast.me" - Data Encoding for Exfiltration in stingxss/engine/analysis/payload_gen.py: "base64.b64encode(" - Brand New Package IOCs: - ipv4: 3.6.0.1 - urls: https://xyz.oast.me, https://your.interactsh.io/x, http://target/#/search?q=test``, https://{host, https://evil (+18 more) - domains: xyz.oast.me, m2.group, anything.com, safe.com, public-firing-range.appspot.com (+3 more) - oastEndpoints: https://xyz.oast.me - payloadFileHash: eca58913a071466ab83bb6281b7d62e148f1504cb330580904f5519fc814e26e