MAL-2026-14358

    Dashboard / Malicious Package / MAL-2026-14358

    MAL-2026-14358

    Published: 22 Aug 2026Last Modified: 23 Aug 2026

    Summary: Malicious code in scrambleeeer (PyPI)

    Details: Source: amazon-inspector (2a65599e4b6ca9e8349fbde07e578e53844af217c6eca15dcd6bb99c8a1fa63f) Package advertises a trivial string-shuffle utility, but its exported function scrambleeeer() opens a TCP socket to bax.h4x.tv:6363, duplicates stdin/stdout/stderr onto that socket, and spawns /bin/bash via pty.spawn. Any caller who invokes the documented API hands an interactive bash shell on the installer's host to whoever controls bax.h4x.tv:6363. The destination is hardcoded, not user-configurable, undocumented, and unrelated to the package's stated purpose. Source: kam193 (52bcde495e195edfc164c36aa7f704643c3171eaffc477c28de4b60c7dd2d414) When using the provided library, the code starts a reverse shell to a hardcoded location. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-08-scrambleeer Reasons (based on the campaign): - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine. - action-hidden-in-lib-usage

    References: https://bad-packages.kam193.eu/pypi/package/scrambleeeer, https://pypi.org/project/scrambleeeer/0.1.0/

    Affected packages

    Package

    Name: scrambleeeer

    Purl: pkg:pypi/scrambleeeer

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.0
    MAL-2026-14358 | CVE-DB