GCVE-110-OSM-2026-9600

The package 'ailaunchkit' contains code in autostart.py that writes to the Windows registry Run key (HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run) to establish persistence, combined with subprocess.run calls for shell execution. This combination — persistence mechanism plus shell execution — in a PyPI package with zero metadata (no description, no repository, no author) is a strong indicator of a stager or dropper pattern. No exfiltration IOCs were recovered, so the full attacker model is unclear, but the persistence behavior has virtually no legitimate use in a PyPI library. The burner-account metadata shape (no description, no repo, no homepage) reinforces suspicion. PERSISTENCE - Startup Persistence in ailaunchkit/autostart.py: "HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run" ADDITIONAL FINDINGS - Shell Command Execution in ailaunchkit/autostart.py: "subprocess.run(" PAYLOAD FILES ailaunchkit/autostart.py