GCVE-110-OSM-2026-9496

This package self-identifies as a dependency-confusion security canary test, explicitly claiming coordination with the vendor's bug bounty program. The code is readable, contains no credential theft, no environment variable exfiltration, and only performs a DNS beacon and HTTP GET to an oastify.com OAST endpoint to confirm the name was resolved from the public index. The version 9999.0.0 and the OAST beacon are intentional dependency-confusion demonstration mechanics, not attacker infrastructure. However, per adjudication rules, bug bounty / dependency confusion test packages that beacon to OAST endpoints should be treated as suspicious-but-benign rather than clean, since the beacon itself does reach an external endpoint on install and the publisher has no prior packages to establish reputation. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - 1 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - OAST/Interactsh Exfiltration in setup.py: "oastify.com" - DNS Lookup in setup.py: "socket.getaddrinfo(" - Suspicious Domain in setup.py: "oastify.com" ADDITIONAL FINDINGS - Setup.py Command Override in setup.py: "cmdclass={ "egg_info": egg_info, "build_py": build_py, "install": install, "deve..." PAYLOAD FILES setup.py