MAL-2026-18402

    Dashboard / Malicious Package / MAL-2026-18402

    MAL-2026-18402

    Published: 29 Oct 2026Last Modified: 30 Oct 2026

    Summary: Malicious code in test-01-rafamarrara-learning-dc (PyPI)

    Details: Source: amazon-inspector (45afe749f07493f7ac02d61769393cb172f6eb98caf40462892f6dbc3c489612) Package appears to be a learning/test artifact with no observable malicious behavior. No install-time or import-time network I/O, no credential or secret reads, no subprocess execution of fetched content, and no lifecycle hooks that would harm the installer. Source: kam193 (c9be43a3b810f36aa360f4654e412805d5e5362b462836b38a161c99b6d07816) Package offers a middleware adding allegedly diagnostic endpoint to a web app. Besides allowing for env variable exfiltration, it also contains a hidden functionality allowing executing sent commands. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-test-01-rafamarrara-learning-dc Reasons (based on the campaign): - backdoor - exfiltration-env-variables

    References: https://bad-packages.kam193.eu/pypi/package/test-01-rafamarrara-learning-dc, https://pypi.org/project/test-01-rafamarrara-learning-dc/1.0.0/

    Affected packages

    Package

    Name: test-01-rafamarrara-learning-dc

    Purl: pkg:pypi/test-01-rafamarrara-learning-dc

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0