GCVE-110-OSM-2026-13490

Malicious PyPI supply-chain component used with webreader 2.3.8. pafer provides a pickle-based configuration loader that deserializes attacker-controlled data before applying its purported type-safety checks. When webreader imports its core module, pafer loads the crafted default configuration, enabling conditional arbitrary code execution and installation of persistent follow-on malware. Static analysis confirmed that pafer.config verifies and decompresses a custom configuration container, then calls pickle.loads before sanitizing the resulting object. This makes the sanitizer ineffective against pickle REDUCE execution. In the paired webreader package, the pickle invokes builtins.eval, decodes multiple obfuscation layers, and conditionally executes when argparse is present in sys.modules. The decoded payload creates a bypit package in site-packages, writes a .pth startup hook, and creates a lock file. On Unix it launches a hidden loader, copies the Python interpreter and network loader into anonymous memfd objects, then executes through /proc/self/fd. On Windows it respawns hidden Python, conditionally invokes pip to install requests, and starts the loader. The final recovered loader performs an HTTPS GET, Base64-decodes the response, and executes it as Python. The remote response was unavailable and remains an unresolved arbitrary-code stage. No credential collection, file exfiltration, or RAT command set was confirmed in the locally recovered stages.