MAL-2026-2138
Dashboard / Malicious Package / MAL-2026-2138
MAL-2026-2138
Summary: Malicious code in open-vp-cal (PyPI)
Details: Source: kam193 (ab8c06b5d7e9b98d62708ab7377d9e18a214e884c69b0c7217979121aed06917) When executing the module, the code installs a package from a remote location. The remote package contains malicious code exfiltrating selected env variables and selected information from credential files. The code claims to be security research. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-03-open-vp-cal Reasons (based on the campaign): - exfiltration-env-variables - Downloads and executes a remote malicious script. - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
Affected packages
Package
Name: open-vp-cal
Purl: pkg:pypi/open-vp-cal
Affected ranges
Type: N/A
Events:
