GCVE-110-OSM-2026-10779

This package is consistent with a downloader/backdoor targeting unsuspecting importers: the module’s top-level import path in `pytablute/__init__.py` calls `t_set_config()`, which decodes a hidden URL, performs `requests.get()` to `https://dothebest.store/allow/{val}.php`, and then feeds the response into a detached `subprocess.Popen([sys.executable, "-"])` execution flow. The attacker model is a supply-chain trojan in a PyPI package, with obfuscated remote code retrieval and silent execution to hide activity from the user. The presence of Unicode-escape obfuscation plus decoded C2/exfil IOC `dothebest.store` and the `decoded-base64` finding makes benign intent implausible. The minimal metadata and module-import trigger further support a throwaway malicious package rather than a legitimate tabular-data library. ENTRY pytablute/__init__.py (module-import: 2396) DESTINATION - 2 exfil (custom-c2) (values recorded in verified_iocs) EXFIL - Network Request in pytablute/__init__.py: "requests.get(" OBFUSCATION - Decoded Base64 Content in pytablute/__init__.py - Unicode Escape Obfuscation in pytablute/__init__.py: "\u0431\u0443\u043a\u0432\u0430" - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in pytablute/__init__.py: "subprocess.Popen(" - Silent Process Execution in pytablute/__init__.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES pytablute/__init__.py