MAL-2026-6383

Dashboard / Malicious Package / MAL-2026-6383

MAL-2026-6383

Summary: Malicious code in gunicorm (PyPI)

Details: Source: amazon-inspector (c97ab7b686dad57c3e1ffd4b86d6a75470164ed15ceedc2b26a4847fb2a331ab) Package name `gunicorm` is a single-character edit of the widely-used `gunicorn` WSGI server and ships no functional code beyond setup.py. setup.py registers custom `install` and `egg_info` cmdclasses so that, on `pip install` or `pip download`, the package captures the full `os.environ` and the output of `ps -elf`, then POSTs the combined data via `curl` to `http://gjampdwmdjmppwedtkpbbdkq05f6iiz6r.oast.fun` (an interactsh OAST collector). Environment variables on developer and CI machines routinely contain AWS keys, registry tokens, and other credentials, all of which are exfiltrated unconditionally to an attacker-controlled endpoint over plain HTTP. The README self-describes the package as a proof-of-concept that runs a command on pip download/install. There is no legitimate functionality. Source: kam193 (91d6bdf640b4cf2b87b464dda65ce3242f4c5c1840f568f0c6b953857c56df57) During installation, the package exfiltrates env variables Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-ip-rotat Reasons (based on the campaign): - The package overrides the install command in setup.py to execute malicious code during installation. - exfiltration-env-variables - typosquatting

References: https://bad-packages.kam193.eu/pypi/package/gunicorm, https://pypi.org/project/gunicorm/0.0.1/