GCVE-110-OSM-2026-6586

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution, network activity. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - oast: http://gjampdwmdjmppwedtkpbbdkq05f6iiz6r.oast.fun (primary, plaintext) in setup.py - custom-c2: gjampdwmdjmppwedtkpbbdkq05f6iiz6r.oast.fun (plaintext) in setup.py EXFIL - OAST/Interactsh Exfiltration in setup.py: ".oast.fun" - Suspicious Domain in setup.py: "oast.fun" ADDITIONAL FINDINGS - Shell Command Execution in setup.py: "subprocess.check_output(" - Setup.py Command Override in setup.py: "cmdclass={"install": RunInstallCommand, "egg_info"" PAYLOAD FILES setup.py INDICATORS (IOCs) - urls: https://packagemanager/simple/, https://embracethered.com/blog/posts/2022/python-package-manager-install-and-download-vulnerability/ - domains: embracethered.com - payloadFileHash: 8109d6e2db3830e5a81e1fc703364e0ff69482c091fa9f4d70fc86e1e5b96c56