GCVE-110-OSM-2026-8188

Malicious package detected. Behaviors: data exfiltration, code execution. ENTRY pypi/needlecraft@1.0.0/needlecraft/exercism.py (console-script: exercism=needlecraft.exercism:main) DESTINATION - custom-c2: http://{url (primary, plaintext) in pypi/needlecraft@1.0.0/needlecraft/api_classes/pincushion.py - custom-c2: https://{url (plaintext) in pypi/needlecraft@1.0.0/needlecraft/api_classes/pincushion.py - custom-c2: https://api.dehashed.com/search (plaintext) in pypi/needlecraft@1.0.0/needlecraft/api_classes/pincushion.py - custom-c2: https://cve.circl.lu/api/cve/ (plaintext) in pypi/needlecraft@1.0.0/needlecraft/api_classes/voodoo.py - custom-c2: https://cve.circl.lu/cve/{ (plaintext) in pypi/needlecraft@1.0.0/needlecraft/api_classes/voodoo.py - custom-c2: https://haveibeenpwned.com/api/v3/breachedaccount/{email_addr (plaintext) in pypi/needlecraft@1.0.0/needlecraft/api_classes/voodoo.py - custom-c2: https://iprep.lcrawl.com/api/iprep/ (plaintext) in pypi/needlecraft@1.0.0/needlecraft/api_classes/voodoo.py - custom-c2: https://download.maxmind.com/app/geoip_download (plaintext) in pypi/needlecraft@1.0.0/needlecraft/api_classes/voodoo.py (+10 more) EXFIL - Python Archive Exfiltration in pypi/needlecraft@1.0.0/needlecraft/api_classes/voodoo.py: "shutil.make_archive(output_filename, 'zip', folder_path) def download_file(self,..." - Data Encoding for Exfiltration in pypi/needlecraft@1.0.0/needlecraft/api_classes/pincushion.py: "base64.b64encode(" - Network Request in pypi/needlecraft@1.0.0/needlecraft/api_classes/nessus_api.py: "requests.get(" - Network Request in pypi/needlecraft@1.0.0/needlecraft/api_classes/pincushion.py: "requests.get(" - Network Request in pypi/needlecraft@1.0.0/needlecraft/api_classes/voodoo.py: "requests.get(" - DNS Lookup in pypi/needlecraft@1.0.0/needlecraft/api_classes/voodoo.py: "socket.gethostbyname(" ADDITIONAL FINDINGS - Shell Command Execution in pypi/needlecraft@1.0.0/needlecraft/api_classes/pincushion.py: "subprocess.run(" - Tunneling Service Usage in pypi/needlecraft@1.0.0/needlecraft/api_classes/pincushion.py: ".onion"" - Silent Process Execution in pypi/needlecraft@1.0.0/needlecraft/api_classes/pincushion.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES pypi/needlecraft@1.0.0/needlecraft/api_classes/pincushion.py (+ pypi/needlecraft@1.0.0/needlecraft/api_classes/voodoo.py) INDICATORS (IOCs) - ipv4: 1.1.1.1 - urls: http://example.onion, http://schemas.openxmlformats.org/wordprocessingml/2006/main, http://officeopenxml.com/WPtableCellMargins.php, https://www.kali.org/tools/sslscan/, https://www.ssllabs.com/ssltest/ (+4 more) - domains: officeopenxml.com, www.kali.org, www.ssllabs.com, redteam-ioc-test.com, redteam-test.com (+2 more) - emails: nldenard@redteam-ioc-test.com, nldenard@redteam-test.com - payloadFileHash: b6ce4f7f14f147621e61c889d1c6fd22daea1138bf995a3f05a668797c625f28