MAL-2026-3805

    Dashboard / Malicious Package / MAL-2026-3805

    MAL-2026-3805

    Published: 16 May 2026Last Modified: 16 May 2026

    Summary: Malicious code in netping (PyPI)

    Details: Source: kam193 (ecc862a2bc12e6779034a99abd68c5d4ffb047f1fc2ae94407dd9e4ad54df5cf) The package silently downloads and installs an autostart script that then monitors clipboards and replaces copied cryptowallet adresses. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-05-netping Reasons (based on the campaign): - persistence - crypto-related - clipboard-modify - Downloads and executes a remote malicious script.

    References: https://bad-packages.kam193.eu/pypi/package/netping

    Affected packages

    Package

    Name: netping

    Purl: pkg:pypi/netping

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    0.2.0