GCVE-110-OSM-2026-10100

This is a classic typosquatting dropper targeting Flask users. The setup.py encodes a base64 payload (_HOOK_B64) that, when decoded, fetches a binary from a GitHub release URL, sets it executable with chmod 0o755, and launches it as a detached background process via subprocess.Popen with stdout/stderr suppressed and start_new_session=True — a textbook dropper/implant execution pattern. The cmdclass override ensures this executes on every pip install. The package has no description, no repository, no author metadata, and the name 'flasq' is a Levenshtein-1 typosquat of 'flask'. The attacker model is supply-chain compromise via typosquatting targeting Linux developer machines. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py OBFUSCATION - Decoded Base64 Content in setup.py - Base64 Encoded Payload in setup.py: "'aW1wb3J0IG9zLCBwbGF0Zm9ybSwgc3VicHJvY2VzcywgdGVtcGZpbGUsIHVybGxpYi5yZXF1ZXN0Cml..." - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Setup.py Command Override in setup.py: "cmdclass={'install'" - Potential Typosquatting PAYLOAD FILES setup.py