GCVE-VVD-OSM-2026-636

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, network activity. Payload: src/__init__.py Secondary files: src/math_mcp.py Key findings: - OAST/Interactsh Exfiltration in src/__init__.py: "oastify.com" - OAST/Interactsh Exfiltration in src/math_mcp.py: "oastify.com" - Suspicious Domain in src/__init__.py: "oastify.com" - Suspicious Domain in src/math_mcp.py: "oastify.com" IOCs: - urls: http://8cld1h2xxoz94uc0iwkj9m3990fr3hr6.oastify.com/__init__?uname={uname, http://8cld1h2xxoz94uc0iwkj9m3990fr3hr6.oastify.com/math_mcp?uname={uname - domains: realpython.com, 8cld1h2xxoz94uc0iwkj9m3990fr3hr6.oastify.com - emails: info@realpython.com - oastEndpoints: http://8cld1h2xxoz94uc0iwkj9m3990fr3hr6.oastify.com/__init__?uname={uname}, http://8cld1h2xxoz94uc0iwkj9m3990fr3hr6.oastify.com/math_mcp?uname={uname} - payloadFileHash: 487944a46a4483f91b1844ebb71c763266a6553a6fb058f5bd04ac0584b40a3e