MAL-2026-2516

    Dashboard / Malicious Package / MAL-2026-2516

    MAL-2026-2516

    Published: 8 Apr 2026Last Modified: 8 Apr 2026

    Summary: Malicious code in sentinel-tool (PyPI)

    Details: Source: kam193 (5a2ff07802c4546c40d47d3780971506115297a1e8c177be36ad1e003dd62937) The package installs a remote executable that uses a hardcoded Telegram channel for monitoring the user's activity, including regularly taking screenshots, and some remote control possibilities like switching the computer off and grabbing clipboard content. Some content suggests it was designed to be used by the uploader themself, but it poses the risk to anyone installing it. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-04-sentinel-tool Reasons (based on the campaign): - Downloads and executes a remote executable. - spyware-like

    References: https://www.virustotal.com/gui/file/53b5e79fad807e269c8e7fdd924839e911ad58795d62dc09a4733833653b3569/detection, https://bad-packages.kam193.eu/pypi/package/sentinel-tool

    Affected packages

    Package

    Name: sentinel-tool

    Purl: pkg:pypi/sentinel-tool

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1
    MAL-2026-2516 | CVE-DB