GCVE-110-OSM-2026-11663

This package is a dropper-style installer that an attacker uses to fetch and execute a Windows payload during a PyPI installation. The decoded base64 in `setup.py` contains a PowerShell script that downloads `enlisted_launcher_1.0.3.190-movn8hpfe.exe` from `https://cdn.discordapp.com/...` and then runs `script.ps1`, which is consistent with malware delivery rather than a legitimate package. The static analyzer also recovered a Discord-hosted URL classified as C2 and flagged `data-exfiltration-encoding` in `utils.py`, while the minimal metadata and no repository support a throwaway burner package profile. The attacker model is a commodity malware operator using a fake game-launcher lure to deliver a remote executable via an install hook. DESTINATION - 3 c2 (domains, urls) (values recorded in verified_iocs) EXFIL - Data Encoding for Exfiltration in utils.py: "json.dumps(data).encode" OBFUSCATION - Decoded Base64 Content in setup.py - Base64 Encoded Payload in setup.py: "'CmltcG9ydCBvcwoKcHNfc2NyaXB0ID0gJycnJHVybCA9ICJodHRwczovL2Nkbi5kaXNjb3JkYXBwLmN..." - recovered 1 urls, 2 domains from decoded/deobfuscated content PAYLOAD FILES setup.py