Re: CVE-2026-95831: Crypt::SelfCertificate versions from 1.01 through 1.05 for Perl contains malware which executes Python code from an obfuscated URL

Versions 1.01 through 1.05 of the Perl CPAN distribution Crypt::SelfCertificate contain embedded malicious code (CWE-506) rather than a conventional software flaw. The module's generate_certificate function executes a Python script that ships disguised as a sample certificate file (lib/Crypt/SelfCertificate/sample/validate.p12 in 1.01, sample/cert7.pem in 1.05). That script decodes a base64-obfuscated, hardcoded HTTP URL, downloads whatever the server returns, and executes the response body directly, giving the attacker fileless arbitrary code execution with the privileges of the user who invoked the module. Anyone who installed these versions and called generate_certificate should assume attacker-controlled code may have run on their host. No CVSS score has been assigned, the issue is not on the CISA KEV list, and no public PoC or confirmed victim executions have been reported, though the malicious payload was distributed through the module's releases.