GCVE-VVD-OSM-2026-188

Malicious package detected. Behaviors: data exfiltration, network activity. Payload: setup.py Key findings: - Environment Variable Exfiltration in setup.py: "os.environ.get("USER") or os.environ.get("USERNAME") or os.environ.get("LOGNAME"..." - System Information Exfiltration in setup.py: "os.getcwd(), } try: d["public_ip"] = urllib.request...." - Python File Upload to Remote in setup.py: "urllib.request.Request( "http://69.164.221.216:8080/callback", ..." - HTTP Data Exfiltration in setup.py: "os.getcwd(), } try: d["public_ip"] = urllib" - IP Lookup Service in setup.py: "ipify.org" IOCs: - ipv4: 69.164.221.216 - urls: http://69.164.221.216:8080/callback - payloadFileHash: f58c4958bb25e17b61d8dc77083c3b0b1c5426105a7f939858541d8fd0e7baa5