MAL-2026-15927

Dashboard / Malicious Package / MAL-2026-15927

MAL-2026-15927

Summary: Malicious code in qoeoe (PyPI)

Details: Source: amazon-inspector (d1e6c0c50dfb4a99c6e8b2ca640cadd33877e737479d8739d5db5b39271bc967) The package ships a single module qoeoe/starts.py whose entire body is a lambda that base64-decodes a reversed ~108 KB string literal and passes the resulting ~80 KB opaque blob directly to exec(). qoeoe/__init__.py imports starts unconditionally, so the decoded payload runs on any `import qoeoe`. The package has an empty README, no advertised functionality, no readable API surface, and no legitimate reason to hide its module body behind reversed+base64 obfuscation piped to exec. This is the import-time loader/dropper shape: arbitrary attacker-controlled code executes on the installer's Python interpreter as soon as the package is imported. Source: kam193 (fb52479116026de0be08479d69a7e28915fc9add4b66ff31152b0a47dc256977) The provided functionality hides code that exfiltrates files to a remote location. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-asti Reasons (based on the campaign): - files-exfiltration - action-hidden-in-lib-usage - target:android

References: https://bad-packages.kam193.eu/pypi/package/qoeoe, https://pypi.org/project/qoeoe/0.1.0/