GCVE-110-OSM-2026-3707

[osmalyze-auto] Malicious package detected. Behaviors: code execution, obfuscated code. [osmalyze-auto] Entrypoint: setup.py (install-hook: install/develop/build override present) Payload: setup.py Key findings: - Python Exec with Encoded Content in setup.py: "exec(binascii" - Decoded Hex String Content in setup.py - Shell Command Execution in setup.py: "subprocess.Popen(" - Python Binascii String Hiding in setup.py: "binascii.unhexlify('" - setup.py Code Execution in setup.py: "class PostInstall(install): def run(self): install.run(self) ..." IOCs: - ipv4: 144.126.142.148 - urls: http://144.126.142.148:5555/tao - ips: 144.126.142.148 - paths: ~/.bittensor/wallets/ - payloadFileHash: 73f02fb81d531d89f995505987577a85b5788a1307b889c1722d96d637320860 Decoded/deobfuscated IOCs: - urls: http://144.126.142.148:5555/tao - ips: 144.126.142.148 - paths: ~/.bittensor/wallets/