GCVE-110-OSM-2026-10097

This looks like a malicious install-time loader targeting a developer workstation: `setup.py` overrides `cmdclass={'install': NativeInstall}` and executes a base64-decoded payload during install. The payload fetches a remote blob from a GitHub release URL, marks it executable with `os.chmod`, and launches it with `subprocess.Popen`, which is consistent with a dropper/loader attacker model rather than a hash library. The hidden URL plus the obfuscated `exec(compile(...))` strongly indicate intentional concealment of behavior. `fast_hashes/compat.py` also performs platform fingerprinting via `platform.system()`, reinforcing that the package is staging platform-specific payload execution on install. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py EXFIL - System Information Collection in fast_hashes/compat.py: "platform.system()" OBFUSCATION - Decoded Base64 Content in setup.py (x6) - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Setup.py Command Override in setup.py: "cmdclass={'install'" PAYLOAD FILES setup.py