MAL-2026-2486

    Dashboard / Malicious Package / MAL-2026-2486

    MAL-2026-2486

    Published: 4 Apr 2026Last Modified: 4 Apr 2026

    Summary: Malicious code in gangomodule (PyPI)

    Details: Source: kam193 (8117683c90fb188f9fc013b3b3006dc5e31269d2511dd7c80eea9ac7b6892d09) During installation, obfuscated code validates the environment against typical sandboxing signs and attempts to download the next stages from remote sources. The remote stage is a comprehensive infostealer collecting credentials from files and process memory, especially SSH keys, and covering tracks to make the forensic analysis more difficult. Naming suggests relation with a toolkit called "Aether" Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-04-gangomodule Reasons (based on the campaign): - Downloads and executes a remote malicious script. - The package contains code to detect if it is running in a sandbox environment. - obfuscation - infostealer - exfiltration-credentials - exfiltration-ssh-keys - files-exfiltration - exfiltration-env-variables - exfiltration-generic - covering-tracks

    References: https://bad-packages.kam193.eu/pypi/package/gangomodule

    Affected packages

    Package

    Name: gangomodule

    Purl: pkg:pypi/gangomodule

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.20
    1.0.37
    MAL-2026-2486 | CVE-DB