GCVE-VVD-OSM-2026-647

Malicious package detected. Behaviors: data exfiltration. Payload: setup.py Key findings: - Environment Variable Exfiltration in setup.py: "os.environ.get("USERNAME", "unknown")), "cwd": os.getcwd(), ..." - System Information Exfiltration in setup.py: "socket.gethostname(), "username": os.environ.get("USER", os.env..." - OAST/Interactsh Exfiltration in setup.py: "pipedream.net" - Python File Upload to Remote in setup.py: "urllib.request.Request( "https://eozfoi3qqahxjst.m.pipedream.ne..." - HTTP Data Exfiltration in setup.py: "os.getcwd(), "researcher": "gaurav", "ecosyste..." IOCs: - urls: https://eozfoi3qqahxjst.m.pipedream.net/poc - domains: eozfoi3qqahxjst.m.pipedream.net - payloadFileHash: b5a8300834747f30e66bbdbe6cdba1a230dbc76a41e0f017ad1530a4c925d2c9