MAL-2026-18300

    Dashboard / Malicious Package / MAL-2026-18300

    MAL-2026-18300

    Published: 25 Oct 2026Last Modified: 26 Oct 2026

    Summary: Malicious code in claudeopusenifile (PyPI)

    Details: Source: kam193 (051daf7dfb8c28210996afbf561646b38781f563483e6c2e7471add0a6021885) During installation, obfuscated code is used to fetch code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-donutautosellsrc Reasons (based on the campaign): - infostealer - Downloads and executes a remote executable. - obfuscation - The package contains code to detect if it is running in a sandbox environment. - malware - native-extension - steganography - c2-in-blockchain

    References: https://www.virustotal.com/gui/file/d03c42c275f0dbc617428441508c49ae1adcbbc95af4eeb094bca4e4f8943f3e/detection, https://polygonscan.com/address/0x9c0a507300fd902787bb193d80fca5ce6e1bff9a, https://bad-packages.kam193.eu/pypi/package/claudeopusenifile

    Affected packages

    Package

    Name: claudeopusenifile

    Purl: pkg:pypi/claudeopusenifile

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.3