MAL-2026-3695

    Dashboard / Malicious Package / MAL-2026-3695

    MAL-2026-3695

    Published: 12 May 2026Last Modified: 13 May 2026

    Summary: Malicious code in pirxcypackage (PyPI)

    Details: Source: amazon-inspector (5de481a31a831804a096bf6cf87157c0b0ee158aa7306c95080447764f9f7540) PirxcyPackage/__init__.py fetches https://pastebin.com/raw/91tFF63S and passes the response body to exec() on every import. This is a textbook remote-code-execution supply-chain pattern: the payload is mutable, unauthenticated, unsigned, and controlled by a third-party paste owner, so any installer importing this package runs arbitrary attacker-chosen Python. The staging via Pastebin also ensures static review of the wheel cannot observe actual behavior. Installer harm is direct and unambiguous.

    References: https://pypi.org/project/PirxcyPackage/8.0.0/

    Affected packages

    Package

    Name: pirxcypackage

    Purl: pkg:pypi/pirxcypackage

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    8.0.0
    MAL-2026-3695 | CVE-DB