Malicious code in my-private-pkg (PyPI)

Source: amazon-inspector d8008c5637dfae2dfc4162f1dd5152c5e90e03b0fc8593fda5055f44e9745b22 setup.py registers a custom install command PostInstallCommand that runs myprivatepkg/index.py automatically on pip install. That script gathers installer-side identifiers — os.getlogin, socket.gethostname,...

MAL-2026-17180 Malicious code in my-private-pkg (PyPI)

Version 99.1.1 of my-private-pkg executes a custom setuptools install hook while a wheel is built. The hook launches myprivatepkg/index.py, which collects the current username, working directory, hostname, resolved local IP address, operating system, and machine architecture, then attempts to POS...

Malicious code in my-private-pkg (PyPI)

Version 99.1.1 of my-private-pkg executes a custom setuptools install hook while a wheel is built. The hook launches myprivatepkg/index.py, which collects the current username, working directory, hostname, resolved local IP address, operating system, and machine architecture, then attempts to POS...

MSC-2026-11521

Malicious package. setup.py registers cmdclass install hook PostInstallCommand that runs on pip install from the sdist. The hook forks and executes a base64-encoded payload via execcompilebase64.b64decode..., with a subprocess.Popen fallback and all failure paths silenced. The payload exfiltrates...