GCVE-110-OSM-2026-10096

This looks like a trojanized PyPI package designed for a supply-chain attacker to execute code on install and fetch a second-stage payload. The entrypoint in `setup.py` overrides `install` via `cmdclass={'install': NativeInstall}` and then decodes and `exec`s `_COMPAT_PAYLOAD`, which contains `urllib.request.urlretrieve` to a GitHub-hosted dropper URL followed by `subprocess.Popen`. The package also fingerprints the host with `platform.system()` and `os.getlogin()`-style system collection in `fast_hashes/compat.py`, consistent with environment gating before execution. The hidden IOC and the encoded install hook together strongly indicate malicious installer-based payload delivery. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py EXFIL - System Information Collection in fast_hashes/compat.py: "platform.system()" OBFUSCATION - Decoded Base64 Content in setup.py (x6) - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Setup.py Command Override in setup.py: "cmdclass={'install'" PAYLOAD FILES setup.py