GCVE-VVD-OSM-2026-697

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, code execution. Payload: remjsonparse/m2.py Secondary files: remjsonparse/m0.py Key findings: - OAST/Interactsh Exfiltration in remjsonparse/m0.py: "workers.dev" - Shell Command Execution in remjsonparse/__init__.py: "subprocess.Popen(" - Silent Process Execution in remjsonparse/__init__.py: "stdout=subprocess.DEVNULL" - Shell Command Execution in remjsonparse/m1.py: "subprocess.run(" - Python File Upload to Remote in remjsonparse/m2.py: "urllib.request.Request(url, data=" IOCs: - ipv4: 8.8.8.8 - urls: https://dry-star-7e02.skyshed.workers.dev - domains: led-mate.com, dry-star-7e02.skyshed.workers.dev - emails: jerryng@led-mate.com - payloadFileHash: 2f48902a7b26b92f5f1e227aa395e83b0f37a0c91dce85fd4282967e1332f3d8