GCVE-110-OSM-2026-8359

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - custom-c2: https://webhook.site/YOUR_UNIQUE_ID?user={ (primary, plaintext) in setup.py - webhookServices: https://webhook.site/YOUR_UNIQUE_ID?user={}&host={} (exfil, plaintext) EXFIL - OAST/Interactsh Exfiltration in setup.py: "Webhook.site" - System Information Exfiltration in setup.py: "socket.gethostname() user = os.getlogin() if hasattr(os, 'getlogin') else "unkno..." - HTTP Data Exfiltration in setup.py: "urllib.request class PostInstall(install): def run(self): install.run(self) # Ge..." - Network Request in setup.py: "urllib.request.urlopen(" - System Information Collection in setup.py: "socket.gethostname()" ADDITIONAL FINDINGS - Setup.py Command Override in setup.py: "cmdclass={'install'" PAYLOAD FILES setup.py INDICATORS (IOCs) - payloadFileHash: e4f7ff5b01a0c3a6ce9ceaddba3889401dba5acf137c5003c220c56c58068745