MAL-2026-4828

    Dashboard / Malicious Package / MAL-2026-4828

    MAL-2026-4828

    Published: 26 May 2026Last Modified: 26 May 2026

    Summary: Malicious code in hmacsync (PyPI)

    Details: Source: kam193 (d361ffcded0fc3d88b5095d800b13b3f8a07a581e8003c30bfcf9887eb71243f) The package is a new version of the previously removed libhmac. The key parts, a malicious payload to inject into hijacked browser extensions, is not included in the package. The code allows hijacking browser extensions to - based on previous package - exfiltrate credentials. This package also contains code to create hidden SSH access to the machine with hardcoded credentials. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-05-libhmac Reasons (based on the campaign): - crypto-related - exfiltration-credentials - exfiltration-crypto - exfiltration-browser-data

    References: https://bad-packages.kam193.eu/pypi/package/hmacsync

    Affected packages

    Package

    Name: hmacsync

    Purl: pkg:pypi/hmacsync

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    MAL-2026-4828 | CVE-DB