MAL-2026-18343

    Dashboard / Malicious Package / MAL-2026-18343

    MAL-2026-18343

    Published: 27 Oct 2026Last Modified: 29 Oct 2026

    Summary: Malicious code in numprint (PyPI)

    Details: Source: amazon-inspector (b2767ab63222f7b2b6c76334822fb6e8c8b0385df53833206362fcf52f93392a) numprint 1.2.0 on PyPI could not be fully characterized from the available signals. No specific installer-harm fingerprint (hardcoded C2, credential path read, home-directory secret scan, install-time fetch-and-execute, dropper, backdoor, self-propagation) is concretely identified in this record. The package name resembles common numeric/printing utility names but no benign purpose is confirmed either. Source: kam193 (ca6ff316077349c92e2d1e5d7c3683a16e6542b952d5c7fc8743efa5d4c80243) During installation the package starts a background process executing commands provided by the attacker. The C2 communication happens through a GitHub Gist. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-numprint Reasons (based on the campaign): - The package overrides the install command in setup.py to execute malicious code during installation. - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine. - rat

    References: https://bad-packages.kam193.eu/pypi/package/numprint, https://pypi.org/project/numprint/1.2.0/

    Affected packages

    Package

    Name: numprint

    Purl: pkg:pypi/numprint

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.2.0