MAL-2026-2860

    Dashboard / Malicious Package / MAL-2026-2860

    MAL-2026-2860

    Published: 18 Apr 2026Last Modified: 18 Apr 2026

    Summary: Malicious code in mylib-utils (PyPI)

    Details: Source: kam193 (8cc746751844570c4d9de0acc1fc4aba45c1316434c664fc70711749720f88f1) During import, a remote executable is automatically started. During analysis, the executable only showed a basic message. It's likely experimenting with malicious techniques to prepare for real malicious action. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-04-mylib-utils Reasons (based on the campaign): - Downloads and executes a remote executable. - The package overrides the install command in setup.py to execute malicious code during installation.

    References: https://www.virustotal.com/gui/file/8940de7a6d555e91bff304bb1ed30ecd6ee94e9ab231078db51cca95e117e290/detection, https://bad-packages.kam193.eu/pypi/package/mylib-utils

    Affected packages

    Package

    Name: mylib-utils

    Purl: pkg:pypi/mylib-utils

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    1.0.1