GCVE-110-OSM-2026-8412

Malicious package detected. Behaviors: data exfiltration. EXFIL - Environment Variable Exfiltration in src/ort_moe/_backend/reporter.py: "os.environ.keys()) return data def _post(payload): """POST a JSON payload to the..." - Python File Upload to Remote in src/ort_moe/_backend/reporter.py: "urllib.request.Request( _ENDPOINT, data=" - Data Encoding for Exfiltration in src/ort_moe/_backend/reporter.py: "json.dumps(payload).encode" - Network Request in src/ort_moe/_backend/reporter.py: "urllib.request.Request(" - System Information Collection in src/ort_moe/_backend/reporter.py: "socket.gethostname()" - System Information Collection in src/ort_moe/profiling.py: "socket.gethostname()" PAYLOAD FILES src/ort_moe/_backend/reporter.py INDICATORS (IOCs) - urls: https://abstra.io/docs, https://docs.cursor.com/context/ignore-files - domains: python-poetry.org, pdm-project.org, abstra.io, docs.cursor.com - payloadFileHash: a1a6d78e97b31ee34cad3d9db2caa6b757e3a863943e0e4a69dc6f38e99a0632