GCVE-110-OSM-2026-13863

The package self-identifies as encoded by 'Black Spammer Bd' (a Bangladesh-based spammer group) and explicitly instructs users not to decode it — an unambiguous adversarial signal, not a false positive. The entrypoint `splogo/cli.py` opens with an anti-debugging guard (`sys.gettrace() is not None → sys.exit(1)`) designed to defeat runtime analysis, a technique used exclusively in malware. All substantive logic is hidden behind `marshal.loads` + `base64` + `zlib` multi-layer encoding in three massively oversized files (276KB, 493KB, 583KB) that exceed deobfuscation limits, meaning the true payload was never exposed. The attacker model is consistent with a spamming or credential-harvesting tool distributed via PyPI, likely targeting Termux (Android) users given the `termux.dev` IOC and the group's known platform. No legitimate library names its encoder after a 'spammer' team and threatens users against decoding its source. ENTRY splogo/cli.py (console-script: splogo=splogo.cli:main) ADDITIONAL FINDINGS - Dangerous Function Calls in setup.py: "marshal.loads(" PAYLOAD FILES setup.py (+ splogo/cli.py, splogo/config.py)