GCVE-110-OSM-2026-648

Malicious package detected. Behaviors: data exfiltration. Payload: setup.py Key findings: - Environment Variable Exfiltration in setup.py: "os.environ.get("USERNAME", "unknown")), "cwd": os.getcwd(), ..." - System Information Exfiltration in setup.py: "socket.gethostname(), "username": os.environ.get("USER", os.env..." - OAST/Interactsh Exfiltration in setup.py: "pipedream.net" - Python File Upload to Remote in setup.py: "urllib.request.Request( "https://eozfoi3qqahxjst.m.pipedream.ne..." - HTTP Data Exfiltration in setup.py: "os.getcwd(), "researcher": "gaurav", "ecosyste..." IOCs: - urls: https://eozfoi3qqahxjst.m.pipedream.net/poc - domains: eozfoi3qqahxjst.m.pipedream.net - payloadFileHash: 2c54409137cc82fa66ece2263727b1ce2b6304c86bf994236797e7e0cc1081b3