GCVE-110-OSM-2026-11040

python-walletlibr-v is a wallet-lookalike PyPI package that ships no wallet functionality — only a stub hello() that prints 'Hello from my custom library!' and placeholder author metadata (__author__ = 'Your Name'). Its setup.py registers a CustomInstall command that, on Windows at pip install time, writes a.bat file into %TEMP%, spawns a new cmd.exe console to execute it via subprocess.Popen(['cmd.exe','/k', bat_path], CREATE_NEW_CONSOLE), and calls os.system('calc'). Arbitrary local command execution fires automatically during pip install on Windows hosts, unrelated to any advertised functionality. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py ADDITIONAL FINDINGS - Shell Command Execution in custom_install.py: "subprocess.Popen(" - Shell Command Variable Setup in custom_install.py: "'cmd.exe', '/k', bat_file], creationflags=subprocess.CREATE_NEW_CONSOLE) # Для L..." - Setup.py Command Override in setup.py: "cmdclass={ 'install'" PAYLOAD FILES setup.py (+ custom_install.py)