GCVE-110-OSM-2026-6525

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, network activity. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - oast: http://gjampdwmdjmppwedtkpbbdkq05f6iiz6r.oast.fun (primary, plaintext) in setup.py - custom-c2: gjampdwmdjmppwedtkpbbdkq05f6iiz6r.oast.fun (plaintext) in setup.py EXFIL - OAST/Interactsh Exfiltration in setup.py: ".oast.fun" - Suspicious Domain in setup.py: "oast.fun" ADDITIONAL FINDINGS - Shell Command Execution in setup.py: "subprocess.check_output(" - Setup.py Command Override in setup.py: "cmdclass={"install": RunInstallCommand, "egg_info"" PAYLOAD FILES setup.py INDICATORS (IOCs) - urls: https://packagemanager/simple/, https://embracethered.com/blog/posts/2022/python-package-manager-install-and-download-vulnerability/ - domains: embracethered.com - payloadFileHash: f412ddb8e55631ff8fdb669a2a93b79e9390eb3e402e5a5f632c27366087d599