MAL-2026-2948

    Dashboard / Malicious Package / MAL-2026-2948

    MAL-2026-2948

    Published: 20 Apr 2026Last Modified: 20 Apr 2026

    Summary: Malicious code in leavemealone (PyPI)

    Details: Source: kam193 (5628eb1d01e8eb7de8a582cd9ea85dff68eafde06f4e1164ae92842354db0bf7) During building the package, it executes encrypted code. The content is unclear as the decryption key bases on the local environment variable. Given leaving a "flag" file at the end, this package can also be part of a CTF-like exercise, but it's not possible to be sure given the encrypted payload. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-04-leavemealone Reasons (based on the campaign): - obfuscation

    References: https://bad-packages.kam193.eu/pypi/package/leavemealone

    Affected packages

    Package

    Name: leavemealone

    Purl: pkg:pypi/leavemealone

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.1
    0.1.2
    MAL-2026-2948 | CVE-DB