GCVE-VVD-OSM-2026-178

Malicious package detected. Behaviors: data exfiltration. Payload: setup.py Key findings: - Environment Variable Exfiltration in setup.py: "os.environ.get("USERNAME", "unknown")), "cwd": os.getcwd(), ..." - System Information Exfiltration in setup.py: "socket.gethostname(), "username": os.environ.get("USER", os.env..." - OAST/Interactsh Exfiltration in setup.py: "pipedream.net" - Python File Upload to Remote in setup.py: "urllib.request.Request( "https://eozfoi3qqahxjst.m.pipedream.ne..." - HTTP Data Exfiltration in setup.py: "os.getcwd(), "researcher": "gaurav", "ecosyste..." IOCs: - urls: https://eozfoi3qqahxjst.m.pipedream.net/poc - domains: eozfoi3qqahxjst.m.pipedream.net - payloadFileHash: 1bf5378d69d576faff6ac3608397cc29994b91c6a815bee05b0548cb0c992718