GCVE-110-OSM-2026-11570

This package hides its real code behind multiple layers of encryption and executes it automatically on import, the concealment is the reason it was flagged, not the payload itself. Execution occurs as soon as infoind is imported, since _init_.py imports the module and the module ends by executing the decrypted result. No user action beyond importing is required. Each layer stores an AES-CBC ciphertext and brute-forces the key by hashing successive integers until the result decodes as valid UTF-8, then passes it to exec(). Unwrapping both layers yields a short script that scrapes Google search results for download links and shells out to pip3 install. The decrypted payload is benign in effect; the risk is that the same delivery mechanism can serve arbitrary code, and the obfuscation defeats source review.