Malicious Package

Overview my-private-pkg is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in my-private-pkg (PyPI)

Source: amazon-inspector d8008c5637dfae2dfc4162f1dd5152c5e90e03b0fc8593fda5055f44e9745b22 setup.py registers a custom install command PostInstallCommand that runs myprivatepkg/index.py automatically on pip install. That script gathers installer-side identifiers — os.getlogin, socket.gethostname,...

MAL-2026-17180 Malicious code in my-private-pkg (PyPI)

Version 99.1.1 of my-private-pkg executes a custom setuptools install hook while a wheel is built. The hook launches myprivatepkg/index.py, which collects the current username, working directory, hostname, resolved local IP address, operating system, and machine architecture, then attempts to POS...

Malicious code in my-private-pkg (PyPI)

Version 99.1.1 of my-private-pkg executes a custom setuptools install hook while a wheel is built. The hook launches myprivatepkg/index.py, which collects the current username, working directory, hostname, resolved local IP address, operating system, and machine architecture, then attempts to POS...