GCVE-110-OSM-2026-10099

This is a classic PyPI installer backdoor aimed at a typosquatting target model: the package name `fastapii` closely impersonates `fastapi`, and `setup.py` overrides the install command via `cmdclass={'install': LinuxInstall}` to execute hidden code on installation. The base64-decoded payload in `_HOOK_B64` downloads a remote file from a GitHub releases URL, writes it to a temp path, `chmod`s it executable, and launches it with `subprocess.Popen`, which is consistent with a remote loader/dropper. The attacker model is supply-chain compromise of developers who install the package, with the install hook ensuring code execution before any normal library use. The minimal metadata and lack of repository further fit a throwaway malicious package rather than a legitimate library. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py OBFUSCATION - Decoded Base64 Content in setup.py - Base64 Encoded Payload in setup.py: "'aW1wb3J0IG9zLCBwbGF0Zm9ybSwgc3VicHJvY2VzcywgdGVtcGZpbGUsIHVybGxpYi5yZXF1ZXN0Cml..." - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Setup.py Command Override in setup.py: "cmdclass={'install'" - Potential Typosquatting PAYLOAD FILES setup.py