MAL-2026-1276

    Dashboard / Malicious Package / MAL-2026-1276

    MAL-2026-1276

    Published: 6 Mar 2026Last Modified: 15 Mar 2026

    Summary: Malicious code in flowfix (PyPI)

    Details: Source: kam193 (77c3304c8fcc8e0cdf2ac450babf481ff0ee3e93cb3c4213c6b4fa8d80cf4137) The package hides code to download and open remote content. The current code seems to be a bit broken as the final URL is not correct, but the code holds also reference to a URL serving an infostealer executable. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-03-flowfix Reasons (based on the campaign): - obfuscation - infostealer - Downloads and executes a remote executable.

    References: https://app.any.run/tasks/da14db45-34c9-465f-80e5-394d433cd21d, https://bad-packages.kam193.eu/pypi/package/flowfix, https://app.any.run/tasks/3a6f9054-be6c-4b33-bcf7-d7504e1f4d52

    Affected packages

    Package

    Name: flowfix

    Purl: pkg:pypi/flowfix

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.0
    0.1.1
    MAL-2026-1276 | CVE-DB