GCVE-110-OSM-2026-8612

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution. ENTRY govpkg/__init__.py (module-import: 8) DESTINATION - custom-c2: https://temp.sh/NBZzm/client (primary, plaintext) in govpkg/_internal.py - custom-c2: http://pkg.go.dev/ (plaintext) in govpkg/govpkg.py - custom-c2: temp.sh (plaintext) in govpkg/_internal.py - urls: https://pkg.go.dev/github.com/spf13/cobra (c2, plaintext) - urls: https://pkg.go.dev (c2, plaintext) - urls: https://pkg.go.dev/ (c2, plaintext) - domains: pkg.go.dev (c2, plaintext) EXFIL - OAST/Interactsh Exfiltration in govpkg/_internal.py: "temp.sh" - Network Request in govpkg/_internal.py: "requests.get(" - Network Request in govpkg/govpkg.py: "requests.get(" ADDITIONAL FINDINGS - Shell Command Execution in govpkg/_internal.py: "subprocess.Popen(" - Silent Process Execution in govpkg/_internal.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES govpkg/_internal.py INDICATORS (IOCs) - payloadFileHash: f449a89daecc6b0642bddaceed4bbb370e9155e709881b3f61b8894b56237fc0