GCVE-110-OSM-2026-8417

Malicious package detected. Behaviors: data exfiltration. ENTRY shan_lib/__init__.py (module-import: 37) DESTINATION - custom-c2: https://oast.nextroot.io/callback (primary, plaintext) in setup.py - custom-c2: https://myorg.okta.com``. (plaintext) in shan_lib/shan_okta_validation.py EXFIL - Python File Upload to Remote in setup.py: "urllib.request.Request( _CALLBACK_HTTP, data=" - System Information Exfiltration in setup.py: "socket.gethostname() label = "".join(c if c.isalnum() or c == "-" else "-" for c..." - Data Encoding for Exfiltration in setup.py: "json.dumps({"h": host, "t": ts, "v": "1.0.7", "e": "install"}).encode" - Python File Upload to Remote in shan_lib/__init__.py: "urllib.request.Request( _CALLBACK_HTTP, data=" - Data Encoding for Exfiltration in shan_lib/__init__.py: "json.dumps({"h": host, "t": ts, "v": __version__}).encode" - Network Request in setup.py: "urllib.request.Request(" - System Information Collection in setup.py: "socket.gethostname()" - DNS Lookup in setup.py: "socket.getaddrinfo(" (+4 more) PAYLOAD FILES setup.py (+ shan_lib/__init__.py) INDICATORS (IOCs) - urls: https://{self.account - domains: euronext.com - emails: shan-digital@euronext.com - payloadFileHash: b0ada63223a65f3e6e1764fdb236e5bf8eb0f41691cd1b222a800c85e653984d