GCVE-110-OSM-2026-8610

This package is a trojanized clone of the legitimate 'tabulate' library, with malicious code inserted into `tb_set_config()`. On import, the package decodes a base64 string (`aHR0cHM6Ly9kb3RoZWJlc3Quc3RvcmUvaw==` → `https://dothebest.store/k`) to construct a C2 URL, fetches a remote Python payload via `requests.get()`, and executes it in a detached subprocess (`subprocess.Popen([sys.executable, '-']`) with all output suppressed via `DEVNULL`. The attacker model is a supply-chain stager: the package masquerades as a table-formatting utility while silently downloading and executing an arbitrary second-stage payload from `dothebest.store` on both Windows (using `DETACHED_PROCESS | CREATE_NEW_PROCESS_GROUP` flags) and POSIX (using `start_new_session=True`). The C2 domain is hidden behind base64 encoding and the execution is fully detached and silent, demonstrating deliberate evasion. ENTRY printrables/__init__.py (module-import: 2387) DESTINATION - custom-c2: https://dothebest.store/k (primary, decoded) in printrables/__init__.py - custom-c2: dothebest.store (decoded) in printrables/__init__.py EXFIL - Network Request in printrables/__init__.py: "requests.get(" OBFUSCATION - Decoded Base64 Content in printrables/__init__.py - Unicode Escape Obfuscation in printrables/__init__.py: "\u0431\u0443\u043a\u0432\u0430" - recovered 1 urls, 1 domains from decoded/deobfuscated content ADDITIONAL FINDINGS - Shell Command Execution in printrables/__init__.py: "subprocess.Popen(" - Silent Process Execution in printrables/__init__.py: "stdout=subprocess.DEVNULL" PAYLOAD FILES printrables/__init__.py INDICATORS (IOCs) - payloadFileHash: ef1ce6faa0d331e4bc7ecbe23f69c2715fd9c7b07accd3332b0db0399e756ab0