MAL-2026-841

    Dashboard / Malicious Package / MAL-2026-841

    MAL-2026-841

    Published: 10 Feb 2026Last Modified: 10 Feb 2026

    Summary: Malicious code in lyroxpy (PyPI)

    Details: Source: kam193 (a9016ac99840c4d68028c7b724382974154c9bf75b410da9c6b4a75ff6d20b1f) The package contains an embedded archive with an executable. When importing the module, the embedded archive is run as a module. Code inside extracts the executable and saves it to a temporary file. Further the code keeps an open file handler and removes the original file, effectively making the impression the file no longer exists. Using the file handler the executable (which is either a native Python module or was created from Python code) is run. Further behavior is not known. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-02-lyroxpy Reasons (based on the campaign): - obfuscation - covering-tracks

    References: https://www.virustotal.com/gui/file/e3395af7390d15c42e779ad72658f397b27927b2dd626b74ce593c26a1ca9184/detection, https://bad-packages.kam193.eu/pypi/package/lyroxpy

    Affected packages

    Package

    Name: lyroxpy

    Purl: pkg:pypi/lyroxpy

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    1.0.1