GCVE-110-OSM-2026-8415

Malicious package detected. Behaviors: code execution. ENTRY setup.py (install-hook: install/develop/build override present) - setup.py Code Execution in setup.py DESTINATION - urls: https://i-like-boys.com/tree.vbs\ (c2, plaintext) ADDITIONAL FINDINGS - Shell Command Execution in setup.py: "subprocess.run(" - Setup.py Command Override in setup.py: "cmdclass={'install'" PAYLOAD FILES setup.py INDICATORS (IOCs) - urls: https://capsule-render.vercel.app/api?type=waving&color=0:E3342F, https://readme-typing-svg.demolab.com?font=Fira+Code&weight=600&size=20&pause=800&color=E3342F&center=true&vCenter=true&width=650&lines=OAuth+2.0+%E2%80%94+No+Cookie+Required;Typed+Models+for+Every+API+Response;Async+%2B+Sync+Clients+Built+In;SQLite+Database+Layer+Included;Open+Cloud+%2B+DataStore+Support;Real-time+Event+System;Marketplace+%26+RAP+Tracking+Tools;Interactive+Terminal+REPL;Production+Ready+%F0%9F%9A%80, https://roboat.pro, http://proxy:8080, https://capsule-render.vercel.app/api?type=waving&color=0:991B1B - domains: capsule-render.vercel.app, readme-typing-svg.demolab.com, roboat.pro - payloadFileHash: a0e112164370f3d5a9c8886ab723028fd12b03e0cde650d6130b5be868c91450