MAL-2026-10908 Malicious code in hello-world-test-mh3 (PyPI)

Package is a trivial hello-world test artifact. setup.py contains an exec(base64.b64decode(…)) call at install time, but the decoded payload is a single print() statement with no network, filesystem, or credential side effects. src/hello_world/init.py defines a _remote_update() function whose urlopen+exec branch is guarded by a constant _SIMULATE_ONLY=True, making the network-fetch-and-exec branch statically unreachable; the reachable branch only execs a local print string. No outbound network occurs, no installer secrets are read, and no attacker-controlled code or destination is referenced. The exec+base64 and import-time fetch-and-exec shapes are present as structural patterns only, with no installer-side harm.