GCVE-VVD-OSM-2026-189

Malicious package detected. Behaviors: data exfiltration, network activity. Payload: setup.py Key findings: - Environment Variable Exfiltration in setup.py: "os.environ.get("USER") or os.environ.get("USERNAME") or os.environ.get("LOGNAME"..." - System Information Exfiltration in setup.py: "os.getcwd(), } try: d["public_ip"] = urllib.request...." - Python File Upload to Remote in setup.py: "urllib.request.Request( "http://69.164.221.216:8080/callback", ..." - HTTP Data Exfiltration in setup.py: "os.getcwd(), } try: d["public_ip"] = urllib" - IP Lookup Service in setup.py: "ipify.org" IOCs: - ipv4: 69.164.221.216 - urls: http://69.164.221.216:8080/callback - payloadFileHash: f7b1e147ead68af6b3394377a00df625640fe8ce4729e1b847779165baf1b455