GCVE-110-OSM-2026-6609

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - custom-c2: http://%s/import?u=%s&h=%s (primary, plaintext) in python_dateutil2/__init__.py - custom-c2: http://%s/%s?%s (plaintext) in setup.py EXFIL - OAST/Interactsh Exfiltration in python_dateutil2/__init__.py: "oastify.com" - OAST/Interactsh Exfiltration in setup.py: "oastify.com" - System Information Exfiltration in python_dateutil2/__init__.py: "socket.gethostname())) except Exception: pass try: urllib" - HTTP Data Exfiltration in python_dateutil2/__init__.py: "getpass.getuser(), socket.gethostname())) except Exception: pass try: urllib" - Network Request in python_dateutil2/__init__.py: "urllib.request.urlopen(" - System Information Collection in python_dateutil2/__init__.py: "socket.gethostname()" - Suspicious Domain in python_dateutil2/__init__.py: "oastify.com" - Network Request in setup.py: "urllib.request.urlopen(" (+2 more) ADDITIONAL FINDINGS - Setup.py Command Override in setup.py: "cmdclass={"install": _Install, "develop"" - Potential Typosquatting PAYLOAD FILES python_dateutil2/__init__.py (+ setup.py) INDICATORS (IOCs) - payloadFileHash: d618c8931fe51cdce92771156cac4eacbdff754ee3b0da87c42fde82ff9fd4ff