CVE-2026-97230: IO::Socket::SSL::SelfCertificate versions 1.00 for Perl contains malware which executes Python code from an obfuscated URL

This is a supply-chain compromise, not a traditional bug: version 1.00 of the Perl CPAN distribution IO::Socket::SSL::SelfCertificate ships embedded malware (CWE-506) rather than legitimate code. When the module's generate_certificate function runs, it executes a Python script disguised as a sample certificate file (lib/IO::Socket::SSL/SelfCertificate/sample/cert.pem), which decodes a base64-obfuscated hardcoded HTTP URL, downloads code from it, and executes the response body directly in memory, leaving no dropped script on the host. An attacker gains arbitrary code execution with the privileges of the user who installed or ran the module. Anyone who downloaded and installed the 1.00 release (tarballs with the published SHA-256 digests ba24ee8e... or d483cb7b...) is affected; the release has no test scripts or build hooks, suggesting the payload may be intended to fire after installation. This mirrors the same scheme as CVE-2026-95831 in the module Crypt::SelfCertificate; no fixed version exists because the entire release is malicious, and no public PoC, CISA KEV listing, or confirmed mass exploitation has been reported.