GCVE-VVD-OSM-2026-646

Malicious package detected. Behaviors: data exfiltration. Payload: setup.py Key findings: - Environment Variable Exfiltration in setup.py: "os.environ.get("USERNAME", "unknown")), "cwd": os.getcwd(), ..." - System Information Exfiltration in setup.py: "socket.gethostname(), "username": os.environ.get("USER", os.env..." - OAST/Interactsh Exfiltration in setup.py: "pipedream.net" - Python File Upload to Remote in setup.py: "urllib.request.Request( "https://eozfoi3qqahxjst.m.pipedream.ne..." - HTTP Data Exfiltration in setup.py: "os.getcwd(), "researcher": "gaurav", "ecosyste..." IOCs: - urls: https://eozfoi3qqahxjst.m.pipedream.net/poc - domains: eozfoi3qqahxjst.m.pipedream.net - payloadFileHash: 198876fe2b259343726af60f1a3d6e2d1799781655e94e828c20e4e3dc4e3d84