MSC-2026-12689

The PyPI package lore-cs version 1.0.0 source distribution is a dependency-confusion package with a malicious install hook. setup.py calls a beacon function at module level, so any pip install from source silently POSTs the hostname, install path and current working directory to an...

Malicious code in lore-cs (PyPI)

Source: kam193 ae8b741b7c90400c3a5f4ba13533b1a6a75134f768934834b591c8df23eecb83 During installation or import, the package exfiltrates basic information in a dependency confusion attempt. The user identifies themselves as a HackerOne user abusing the PyPI for the purpose of a bug bounty program...

MAL-2026-17639 Malicious code in lore-cs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84e496d81c3e514ec784db2d5996a9015fa9f01f50cb75a99011eb348b2aa07 lore-cs 1.0.0 executes an outbound HTTP POST both from setup.py at install time and from lorecs/init.py at import time to the hardcoded bare-IP...

Malicious code in lore-cs (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f84e496d81c3e514ec784db2d5996a9015fa9f01f50cb75a99011eb348b2aa07 lore-cs 1.0.0 executes an outbound HTTP POST both from setup.py at install time and from lorecs/init.py at import time to the hardcoded bare-IP...

Malicious Package

Overview lore-cs is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...