GCVE-110-OSM-2026-9417

This package implements a classic supply-chain exfiltration attack. The setup.py defines an `analytics()` function that collects hostname, username, current working directory, and the full environment variable set (`dict(os.environ)`), then POSTs this JSON payload to a Cloudflare Worker acting as a data forwarder controlled by the author 'adamintigrititest'. The exfiltration runs twice: once at module load time (`analytics()` called at top level) and again via the `PostInstallCommand` install hook override, ensuring execution both on `pip install` and on direct `python setup.py install`. The package has zero dependents, no description, no repository, and was published by a zero-history account — all consistent with a disposable credential-harvesting package. The attacker model is environment variable and identity theft on developer machines during package installation. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py EXFIL - Python File Upload to Remote in setup.py: "urllib.request.Request( "https://request-forwarder.a-d-a-m.workers.dev/", data=" - Data Encoding for Exfiltration in setup.py: "json.dumps(data).encode" - Network Request in setup.py: "Request( "https:" - System Information Collection in setup.py: "socket.gethostname()" ADDITIONAL FINDINGS - Setup.py Command Override in setup.py: "cmdclass={"install"" PAYLOAD FILES setup.py