MAL-2026-5756

Dashboard / Malicious Package / MAL-2026-5756

MAL-2026-5756

Summary: Malicious code in easyaillm (PyPI)

Details: Source: amazon-inspector (b6268f175708584b9c3de408c80de3dc1162f4d1ddedb1ce6201b90f409b0dea) On `pip install easyaillm`, setup.py runs `exec(base64.b64decode(...))` which decodes to code that fetches https://pastebin.com/raw/hEF5HaFc, treats the response body as a second URL, downloads that URL's bytes to `pkg_installer.exe`, and executes it via `os.system('cmd /c pkg_installer.exe')`. The attack stages are concealed behind a base64 blob and `exec()` indirection, while the package metadata advertises an unrelated LLM/Roblox API purpose as cover. The pastebin source is mutable and anonymous, allowing the operator to swap the second-stage URL and ultimately the executed binary at any time. Installing this package on Windows results in arbitrary attacker-controlled code execution on the installer's machine. Source: kam193 (a08d3871109fa50918608928ea7aaa533e5f99ac68cb20cbaa9558836f3d44bd) During installation, the obfuscsted code attempts to download and start a malicious executable. The published versions contained issues preventing successful downloading, but it was possible to recover the intended executable during the analysis. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-easyaillm Reasons (based on the campaign): - Downloads and executes a remote executable. - obfuscation - malware - tool:mshta

References: https://bad-packages.kam193.eu/pypi/package/easyaillm, https://pypi.org/project/easyaillm/2.0.15/, https://www.virustotal.com/gui/file/1a5beab4a6facb46b4afc5f8526e1327e6c7d740ccaf34c6a921ac18eff29427/detection, https://www.virustotal.com/gui/file/4c99c8edfc4444f46932f14afccb2952a3850df765765f9ac793d69f318c192f/detection, https://www.virustotal.com/gui/file/0649f50ead3695f41c1243883200bdb775410bcd8c8fb88277740a625a154e25, https://www.virustotal.com/gui/file/926e8f1a7f349ff1eef31f89fa8ffe265c30b92e310e8bea19962d38f8c32129