GCVE-110-OSM-2026-7834

This package implements a textbook supply-chain implant with three clear attacker goals: reconnaissance, C2 callback, and data exfiltration. The package masquerades as a 'zero-dependency drop-in replacement for python-dotenv' with no metadata, no repository, and a burner publisher account, consistent with a typosquatting or dependency confusion campaign targeting developer environments. The `_internal.py` module encodes two dead-drop URLs (a GitHub Gist under 'opensource-crypto' and a GitLab snippet under 'devtool-labs') in base64, fetches attacker-controlled JSON at runtime to retrieve a dynamic C2 address, then POSTs a system fingerprint — hostname, platform, arch, cwd, home directory, PID, sensitive environment variable names (filtering for 'key', 'secret', 'token', 'password', 'auth', 'wallet', 'seed', 'mnemonic'), and SSH key file listings — to that C2 via HTTPS. A 72–96 hour activation delay keyed to `socket.gethostname()` is explicitly implemented to evade sandbox analysis. DESTINATION - custom-c2: https://gist.githubusercontent.com/opensource-crypto/3946ef88aa057c9d10f1a7d80391d164/raw/default.json (primary, decoded) in pypi/fast-dotenv@1.0.0/fast_dotenv/_internal.py - custom-c2: https://gitlab.com/devtool-labs/config-snippets/raw/main/default.json (decoded) in pypi/fast-dotenv@1.0.0/fast_dotenv/_internal.py - custom-c2: gist.githubusercontent.com (decoded) in pypi/fast-dotenv@1.0.0/fast_dotenv/_internal.py - custom-c2: gitlab.com (decoded) in pypi/fast-dotenv@1.0.0/fast_dotenv/_internal.py - custom-c2: https://{target (plaintext) in pypi/fast-dotenv@1.0.0/fast_dotenv/_internal.py EXFIL - Python File Upload to Remote in pypi/fast-dotenv@1.0.0/fast_dotenv/_internal.py: "urllib.request.Request( url, data=" - Data Encoding for Exfiltration in pypi/fast-dotenv@1.0.0/fast_dotenv/_internal.py: "json.dumps(data).encode" - Network Request in pypi/fast-dotenv@1.0.0/fast_dotenv/_internal.py: "urllib.request.Request(" - System Information Collection in pypi/fast-dotenv@1.0.0/fast_dotenv/_internal.py: "socket.gethostname()" OBFUSCATION - Decoded Base64 Content in pypi/fast-dotenv@1.0.0/fast_dotenv/_internal.py (x2) - Base64 Encoded Payload in pypi/fast-dotenv@1.0.0/fast_dotenv/_internal.py: ""aHR0cHM6Ly9naXN0LmdpdGh1YnVzZXJjb250ZW50LmNvbS9vcGVuc291cmNlLWNyeXB0by8zOTQ2ZWY..." - recovered 2 urls, 2 domains from decoded/deobfuscated content PAYLOAD FILES pypi/fast-dotenv@1.0.0/fast_dotenv/_internal.py INDICATORS (IOCs) - payloadFileHash: 3d96109552544fc096eb9634d73a1f4cf5ecb7996522a5d2733d891d83234a9b