GCVE-110-OSM-2026-8433

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - custom-c2: https://3c129215093f30ee142e4d60f314fb30.m.pipedream.net/hello (primary, plaintext) in emergentintegrations/__init__.py - custom-c2: 3c129215093f30ee142e4d60f314fb30.m.pipedream.net (plaintext) in emergentintegrations/__init__.py EXFIL - OAST/Interactsh Exfiltration in emergentintegrations/__init__.py: "pipedream.net" - OAST/Interactsh Exfiltration in emergentintegrations/main.py: "pipedream.net" - Python File Upload to Remote in emergentintegrations/__init__.py: "urllib.request.Request( "https://3c129215093f30ee142e4d60f314fb30.m.pipedream.ne..." - Data Encoding for Exfiltration in emergentintegrations/__init__.py: "json.dumps({"installed_version": "1.0.0"}).encode" - Python File Upload to Remote in emergentintegrations/main.py: "urllib.request.Request( "https://3c129215093f30ee142e4d60f314fb30.m.pipedream.ne..." - Data Encoding for Exfiltration in emergentintegrations/main.py: "json.dumps(data).encode" - Network Request in emergentintegrations/__init__.py: "Request( "https:" - Network Request in emergentintegrations/main.py: "Request( "https:" ADDITIONAL FINDINGS - Platform Detection with Data Collection in emergentintegrations/main.py: "platform.platform() data = { "user": user, "hostname": hostname, "os": os_info }..." - Shell Command Execution in setup.py: "subprocess.call(" - Setup.py Command Override in setup.py: "cmdclass={ "install": PostInstall, "develop"" PAYLOAD FILES emergentintegrations/main.py (+ emergentintegrations/__init__.py) INDICATORS (IOCs) - payloadFileHash: af1533d8b1a046439c3b42e2369ad8c11ade20435f0b92f67f81cbf643761ec3