GCVE-110-OSM-2026-3281

Malicious package detected. Behaviors: code execution. Payload: setup.py Key findings: - Shell Command Execution in setup.py: "subprocess.run(" - setup.py Code Execution in setup.py: "class CustomInstall(install): def run(self): install.run(self) ..." - Setup.py Command Override in setup.py: "cmdclass={'install'" IOCs: - urls: https://capsule-render.vercel.app/api?type=waving&color=0:E3342F, https://readme-typing-svg.demolab.com?font=Fira+Code&weight=600&size=20&pause=800&color=E3342F&center=true&vCenter=true&width=650&lines=OAuth+2.0+%E2%80%94+No+Cookie+Required;Typed+Models+for+Every+API+Response;Async+%2B+Sync+Clients+Built+In;SQLite+Database+Layer+Included;Open+Cloud+%2B+DataStore+Support;Real-time+Event+System;Marketplace+%26+RAP+Tracking+Tools;Interactive+Terminal+REPL;Production+Ready+%F0%9F%9A%80, https://roboat.pro, http://proxy:8080, https://capsule-render.vercel.app/api?type=waving&color=0:991B1B - domains: capsule-render.vercel.app, readme-typing-svg.demolab.com, roboat.pro - payloadFileHash: e174699649cd58c96aa49cfb08fd11dabeb5eed3aed2647065522eea2733d966