GCVE-VVD-OSM-2026-637

Malicious package detected. Behaviors: data exfiltration, network activity. Payload: setup.py Key findings: - Environment Variable Exfiltration in setup.py: "os.environ.get("CI") or os.environ.get("JENKINS_URL") or os.environ.get("GITLAB_..." - System Information Exfiltration in setup.py: "os.getcwd(), "ci": os.environ.get("CI") or os.environ.get("JENKINS_U..." - Webhook Data Exfiltration in setup.py: "discord.com/api/webhooks/1484422878647816244/8gbHLu2n7XXXqlDGn3ZXxfzS-PuKnZF3Mvn..." - Python File Upload to Remote in setup.py: "urllib.request.Request("http://69.164.221.216:8080/callback", data=" - IP Lookup Service in setup.py: "ipify.org" IOCs: - ipv4: 69.164.221.216 - urls: http://69.164.221.216:8080/callback - discordWebhooks: https://discord.com/api/webhooks/1484422878647816244/8gbHLu2n7XXXqlDGn3ZXxfzS-PuKnZF3Mvn52eHIKU23-exdJLaWOcpey0pPnDAR0KQo - payloadFileHash: 195a5b6e19f6552c103e0ebbed7880e86106d350df79a023d3565a0139aa9836