GCVE-VVD-OSM-2026-257

This package was part of a hyper targeted dependency confusion attack. The threat actors used stolen information to craft PyPI packages they knew would run in the victim's CI/CD pipelines The threat actor crafted custom malware that would only run in GitHub Actions, and if it identified that it was NOT in a CI pipeline, it would exit. The payload then analyzed whether it was in the correct victim's account and in the right GitHub Action. If it found that it was, it exfiltrated every variable and credential it had to an IP address 77.91.65.24. The malware then downloads additional payloads from 91.184.247.242 and 1.46.221.5