MAL-2026-14488 Malicious code in python-walletlibr-v (PyPI)

python-walletlibr-v is a wallet-lookalike PyPI package that ships no wallet functionality — only a stub hello() that prints 'Hello from my custom library!' and placeholder author metadata (author = 'Your Name'). Its setup.py registers a CustomInstall command that, on Windows at pip install time, writes a.bat file into %TEMP%, spawns a new cmd.exe console to execute it via subprocess.Popen(['cmd.exe','/k', bat_path], CREATE_NEW_CONSOLE), and calls os.system('calc'). Arbitrary local command execution fires automatically during pip install on Windows hosts, unrelated to any advertised functionality.