GCVE-110-OSM-2026-8411

Malicious package detected. Behaviors: data exfiltration. EXFIL - Environment Variable Exfiltration in src/promptflow_runtime/_diagnostics/reporter.py: "os.environ.keys()) return data def _post(payload): """POST a JSON payload to the..." - Python File Upload to Remote in src/promptflow_runtime/_diagnostics/reporter.py: "urllib.request.Request( _ENDPOINT, data=" - Data Encoding for Exfiltration in src/promptflow_runtime/_diagnostics/reporter.py: "json.dumps(payload).encode" - Network Request in src/promptflow_runtime/_diagnostics/reporter.py: "urllib.request.Request(" - System Information Collection in src/promptflow_runtime/_diagnostics/reporter.py: "socket.gethostname()" - System Information Collection in src/promptflow_runtime/info.py: "socket.gethostname()" PAYLOAD FILES src/promptflow_runtime/_diagnostics/reporter.py INDICATORS (IOCs) - urls: https://abstra.io/docs, https://docs.cursor.com/context/ignore-files - domains: python-poetry.org, pdm-project.org, abstra.io, docs.cursor.com - payloadFileHash: f14b2f87e3b6d3c078d9dff43dcc05243400f2f191578a7302e22b7e16a662c8