GCVE-VVD-OSM-2026-649

Malicious package detected. Behaviors: data exfiltration. Payload: setup.py Key findings: - Environment Variable Exfiltration in setup.py: "os.environ.get("USERNAME", "unknown")), "cwd": os.getcwd(), ..." - System Information Exfiltration in setup.py: "socket.gethostname(), "username": os.environ.get("USER", os.env..." - OAST/Interactsh Exfiltration in setup.py: "pipedream.net" - Python File Upload to Remote in setup.py: "urllib.request.Request( "https://eozfoi3qqahxjst.m.pipedream.ne..." - HTTP Data Exfiltration in setup.py: "os.getcwd(), "researcher": "gaurav", "ecosyste..." IOCs: - urls: https://eozfoi3qqahxjst.m.pipedream.net/poc - domains: eozfoi3qqahxjst.m.pipedream.net - payloadFileHash: db9cbbb2df8763aa3453e1084f86ebdff77a7d65cefd01c7306cb311c20189c9