GCVE-110-OSM-2026-13489

Malicious PyPI package containing a crafted pickle disguised as a compressed default configuration. Importing webreader causes its pafer dependency to deserialize the configuration, enabling conditional arbitrary code execution, Python startup persistence, and retrieval and execution of an unresolved remote Python stage. webreader declares an unpinned dependency on pafer and imports pafer modules during package initialization. At the end of webreader.core initialization, it requests default configuration loading. pafer locates webreader/default.config, validates its custom checksum and size header, decompresses its XZ payload, and calls pickle.loads. The pickle invokes builtins.eval and unwraps Base64 and XOR-obfuscated Python. Execution is gated on argparse already being present in sys.modules. When triggered, the payload creates bypit/__init__.py and bypit/__cached__.py under site-packages and writes mypyc_abi3.pth containing an import of bypit, causing execution during later Python startups. A temporary lock file prevents concurrent launches. The Unix branch redirects output, uses memfd-backed copies of Python and the loader, forks, and executes through /proc/self/fd. The Windows branch uses an environment staging guard, hidden Python processes, a file lock, and pip installation of requests before running the loader. The final loader retrieves text over HTTPS, Base64-decodes it, and executes it. That server-controlled response was not retrieved, so downstream behavior and any additional payloads remain unresolved. No exfiltration behavior or RAT protocol was confirmed in the recovered local stages.