GCVE-110-OSM-2026-8357

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - oast: http://d7qh7mvqeopkaunioanggiqggobn1ms35.oast.site/?user={}&host={} (primary, plaintext) in setup.py - custom-c2: http://d7qh7mvqeopkaunioanggiqggobn1ms35.oast.site/?user={ (plaintext) in setup.py - custom-c2: d7qh7mvqeopkaunioanggiqggobn1ms35.oast.site (plaintext) in setup.py EXFIL - OAST/Interactsh Exfiltration in setup.py: "oast.site" - System Information Exfiltration in setup.py: "socket.gethostname() user = os.getlogin() if hasattr(os, 'getlogin') else "unkno..." - Network Request in setup.py: "urllib.request.urlopen(" - System Information Collection in setup.py: "socket.gethostname()" - Suspicious Domain in setup.py: "http://d7qh7mvqeopkaunioanggiqggobn1ms35.oast" ADDITIONAL FINDINGS - Setup.py Command Override in setup.py: "cmdclass={'install'" PAYLOAD FILES setup.py INDICATORS (IOCs) - payloadFileHash: 881cd8ac95c8d9c57d50eacd35ca94fc00db872d36c028460a08fcb984b87ceb