GCVE-110-OSM-2026-13943

This package claims to be a "small utility helpers", but really, is a super simple loader. setup.py downloads a second stage loader from a Cloudflare worker endpoint and runs it silently in the background. The package name 'debbug' is a Levenshtein-1 typosquat of 'debug', a commonly imported development package, fitting the campaign's stated typosquatting methodology. The package installs a silent subprocess via `subprocess.Popen` with `stdout=subprocess.DEVNULL` inside `setup.py`, meaning arbitrary code executes at pip install time with output deliberately suppressed to evade detection. The use of `os.getpid()` in the same file is consistent with sandbox/environment fingerprinting before executing a payload — a known pre-check pattern in infostealer droppers. ADDITIONAL FINDINGS - Shell Command Execution in setup.py: "subprocess.Popen(" - Silent Process Execution in setup.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES setup.py