MAL-2026-17847

    Dashboard / Malicious Package / MAL-2026-17847

    MAL-2026-17847

    Published: 12 Oct 2026Last Modified: 29 Oct 2026

    Summary: Malicious code in npp-ml (PyPI)

    Details: Source: amazon-inspector (3ac13184b04573151fc11ac8de28c384f016b49ed76d8689f46cf5c24909feca) The package's setup.py declares `scripts=['bin/python']`, which causes pip to copy the file literally named `python` into the installer's script directory (e.g. a virtualenv `bin/`, `/usr/local/bin/`, or `Scripts\` on Windows). The shipped `bin/python` file is not a Python script — it begins with ZIP magic `PK\x03\x04` and contains a bundled Windows Python 3.10 distribution (`python310.dll`, `pythonw.exe`, `_ssl.pyd`, `libssl-1_1.dll`, `python310.zip`). After install, invoking `python` from the affected directory resolves to this non-executable archive rather than a real interpreter, breaking the `python` command for anything that resolves it from that directory first. The archive contents are a stock Windows Python runtime and do not contain outbound network code, credential access, or persistence mechanisms; the harm is local breakage of the installer's interpreter command, not exfiltration or remote code execution. Source: kam193 (7f575d02caf2363703b49c45c7f5ba106b798ee4f5b02f1977b118f2b52ff30e) The package claims to provide a Notepad++ distribution, but in fact delivers ADExplorer, an Active Directory analysis tool. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-npp-ml Reasons (based on the campaign): - other - impersonation

    References: https://bad-packages.kam193.eu/pypi/package/npp-ml, https://pypi.org/project/npp-ml/0.1.10/

    Affected packages

    Package

    Name: npp-ml

    Purl: pkg:pypi/npp-ml

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.7
    0.1.8
    0.1.9
    0.1.10