MAL-2026-916

    Dashboard / Malicious Package / MAL-2026-916

    MAL-2026-916

    Published: 16 Feb 2026Last Modified: 19 Mar 2026

    Summary: Malicious code in alibabacloude (PyPI)

    Details: Source: kam193 (c45df7f85cfaba4bf141f0a17ba2d0987e080131bab1f1233798a1287d63fa7f) Series of packages impersonating Alibaba Cloud. Two oldest hide code to run obfuscated code, but are likely to be used as dependency as the obfuscated code is not inside. The newest describe similar functionality, but the inside is highly obfuscated. Package names closely reassemble names of real Alibaba packages Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-02-alibabacloude Reasons (based on the campaign): - typosquatting - impersonation - obfuscation

    References: https://bad-packages.kam193.eu/pypi/package/alibabacloude, https://github.com/kam193/package-campaigns/blob/97de615c16496639c059ee2f62c5dd7d88ac06eb/pypi/packages/malicious/osv/alibabacloude.json#L3

    Affected packages

    Package

    Name: alibabacloude

    Purl: pkg:pypi/alibabacloude

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.2.0
    MAL-2026-916 | CVE-DB