MAL-2026-10973

Dashboard / Malicious Package / MAL-2026-10973

MAL-2026-10973

Summary: Malicious code in fluffy-octo-broccoli (PyPI)

Details: Source: amazon-inspector (b017d48fb884ba615e0b62dfd421f8fe24e52695a7ae86c8c158eb2ded44286f) fluffy-octo-broccoli ships a 10.7 MB `qiwi.zip` archive whose contents yield no readable filenames or strings via extraction, alongside a `run.sh` that unzips the archive in the current working directory, chmods `start.sh` executable, and runs it. The package's console-script entry (`launcher.py`) invokes `bash run.sh` via subprocess. The README's only stated purpose is 'Runs the bundled startup script when installed,' with no description of what the executed shell payload actually does. The archive's opacity prevents any inspection of the code that will run when the CLI is invoked. Execution is not automatic on `pip install` — the user must invoke the console script — but once invoked, the executed shell content is completely undocumented and unverifiable. Source: kam193 (ed721bd4c1baf8e69a7f3c5039ac5644b8c6f0795e87fc711d3cd2b0a523c1e1) In this campaign, packages use names similar to popular services (e.g. Kimi AI) to deploy cryptominer. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-kimichat Reasons (based on the campaign): - cryptominer

References: https://github.com/newbroughblueogwin/automatic-octo-invention, https://bad-packages.kam193.eu/pypi/package/fluffy-octo-broccoli, https://pypi.org/project/fluffy-octo-broccoli/0.1.0/