GCVE-VVD-OSM-2026-190

Malicious package detected. Behaviors: data exfiltration, network activity. Payload: setup.py Key findings: - Environment Variable Exfiltration in setup.py: "os.environ.get("USER") or os.environ.get("USERNAME") or os.environ.get("LOGNAME"..." - System Information Exfiltration in setup.py: "os.getcwd(), } try: d["public_ip"] = urllib.request...." - Python File Upload to Remote in setup.py: "urllib.request.Request( "http://69.164.221.216:8080/callback", ..." - HTTP Data Exfiltration in setup.py: "os.getcwd(), } try: d["public_ip"] = urllib" - IP Lookup Service in setup.py: "ipify.org" IOCs: - ipv4: 69.164.221.216 - urls: http://69.164.221.216:8080/callback - payloadFileHash: cc62934c720871a34ae93d07c7eaba43007c81c650012ac8a22d02d70735b991