MAL-2026-3105

    Dashboard / Malicious Package / MAL-2026-3105

    MAL-2026-3105

    Published: 27 Apr 2026Last Modified: 27 Apr 2026

    Summary: Malicious code in mypypipkg (PyPI)

    Details: Source: kam193 (a94a9bbd6a292f754fedd6ae737eaf5259925cf382a610c9d63e9d210a3f3677) When running as a module, the package starts a VSCode tunnel and exfiltrates the connection link to the hardcoded target. This lets the attacker connect the VSCode instance online and gain remote access to the machine as the user running the code. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-04-old-mypypipkg Reasons (based on the campaign): - vscode-tunnel

    References: https://bad-packages.kam193.eu/pypi/package/mypypipkg

    Affected packages

    Package

    Name: mypypipkg

    Purl: pkg:pypi/mypypipkg

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.1.0
    0.1.1