GCVE-110-OSM-2026-10780

This is a classic supply-chain installer backdoor aimed at Linux users installing the package: `setup.py` overrides `install` via `cmdclass={'install': LinuxInstall}` and executes `_post_install()` during installation. The embedded base64 payload decodes to Python that downloads a remote file from `https://github.com/totti2188/8gp1Q7iZD3h4VW/releases/download/v1.3A/something`, marks it executable, and launches it with `subprocess.Popen`, which is consistent with a remote loader/dropper. The attacker model is a maintainer or typosquatter distributing a fake package (`pydanticc`) to execute an arbitrary payload on victim machines at install time. The decoded URL in `setup.py`, the `base64-payload`, and the install-hook code execution together leave no plausible benign explanation. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py OBFUSCATION - Decoded Base64 Content in setup.py - Base64 Encoded Payload in setup.py: "'aW1wb3J0IG9zLCBwbGF0Zm9ybSwgc3VicHJvY2VzcywgdGVtcGZpbGUsIHVybGxpYi5yZXF1ZXN0Cml..." - recovered 1 urls from decoded/deobfuscated content ADDITIONAL FINDINGS - Setup.py Command Override in setup.py: "cmdclass={'install'" PAYLOAD FILES setup.py