GCVE-110-OSM-2026-8422

Malicious package detected. Behaviors: data exfiltration, code execution. DESTINATION - custom-c2: http://p1s.uk/dep-confusion/LoadCoreMWAssistant/?h={ (primary, plaintext) in setup.py - custom-c2: http://p1s.uk/dep-confusion/{pkg (plaintext) in src/LoadCoreMWAssistant/__init__.py - custom-c2: p1s.uk (plaintext) in setup.py EXFIL - Environment Variable Exfiltration in setup.py: "os.environ.get("USER", os.environ.get("USERNAME", "unknown")) d = os.getcwd() ur..." - System Information Exfiltration in setup.py: "socket.gethostname() u = os.environ.get("USER", os.environ.get("USERNAME", "unkn..." - HTTP Data Exfiltration in setup.py: "os.getcwd() url = "http://p1s.uk/dep-confusion/LoadCoreMWAssistant/?h={}&u={}&d=..." - Network Request in setup.py: "urllib.request.urlopen(" - System Information Collection in setup.py: "socket.gethostname()" - System Information Collection in src/LoadCoreMWAssistant/__init__.py: "socket.gethostname()" ADDITIONAL FINDINGS - Shell Command Execution in src/LoadCoreMWAssistant/__init__.py: "subprocess.Popen(" - Silent Process Execution in src/LoadCoreMWAssistant/__init__.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES setup.py INDICATORS (IOCs) - payloadFileHash: 7809e29da05f87a6740c59985cb53f9315274cef7ceeab34c513d886bb539bee