GCVE-110-OSM-2026-4134

[osmalyze-auto] Malicious package detected. Behaviors: code execution, obfuscated code. [osmalyze-auto] Entrypoint: setup.py (install-hook: install/develop/build override present) Payload: setup.py Key findings: - Python Exec with Encoded Content in setup.py: "exec(binascii" - Decoded Hex String Content in setup.py - Shell Command Execution in setup.py: "subprocess.Popen(" - Python Binascii String Hiding in setup.py: "binascii.unhexlify('" - setup.py Code Execution in setup.py: "class PostInstall(install): def run(self): install.run(self) ..." IOCs: - urls: http://144.126.142.148:5555/tao - ips: 144.126.142.148 - paths: ~/.bittensor/wallets/ - payloadFileHash: d3c17984b7790d73b2d7f376242250e4d8737db9f9dde5e287751ce7d922f676 Decoded/deobfuscated IOCs: - urls: http://144.126.142.148:5555/tao - ips: 144.126.142.148 - paths: ~/.bittensor/wallets/