MAL-2026-6248

Dashboard / Malicious Package / MAL-2026-6248

MAL-2026-6248

Summary: Malicious code in jsonschema-viewer (PyPI)

Details: Source: amazon-inspector (3692022b4caf5ac51d868aaae58e793520ac3bd36703841eb615942baf85bb87) The package's only function — main() in src/jsonschema_viewer/main.py, registered as the `jsonschema-viewer` console script — invokes os.system to fetch a shell script from http://49.232.169.67:8084/slt via curl or wget and pipes the response into `sh`. The fetch uses plaintext HTTP to a bare IP with no pinning, no hash verification, and an opaque payload, and bears no relationship to the package's advertised purpose ('A minimal jsonschema-viewer package'). Author metadata is the placeholder 'Your Name' with no email/URL and the README is a single empty sentence, consistent with a throwaway dropper package. Any developer who installs this package and runs the documented CLI executes arbitrary attacker-controlled code on their machine. Source: kam193 (76cad60a803b91e4da8eb438787ca5f044fd3deafedef5de1fdb4e92bd8fd9e1) Package configures an entry point (command line) that executes a remote script. It then downloads a next stage malware, which acts as next dropper for a fileless malware. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-jsonschema-viewer Reasons (based on the campaign): - malware - Downloads and executes a remote executable. - Downloads and executes a remote malicious script.

References: https://www.virustotal.com/gui/file/bd77582bcc534db6a56f1471f8134296a5f39b90c7ec2761e14e7ccef4667ab4/detection, https://bad-packages.kam193.eu/pypi/package/jsonschema-viewer, https://pypi.org/project/jsonschema-viewer/0.1.0/