MAL-2026-917

    Dashboard / Malicious Package / MAL-2026-917

    MAL-2026-917

    Published: 16 Feb 2026Last Modified: 19 Mar 2026

    Summary: Malicious code in aliyun-python-sdk-v2 (PyPI)

    Details: Source: kam193 (29bd2455a576643c51939bd166abab847afd04c3142b576e3f9f0c7978763181) Series of packages impersonating Alibaba Cloud. Two oldest hide code to run obfuscated code, but are likely to be used as dependency as the obfuscated code is not inside. The newest describe similar functionality, but the inside is highly obfuscated. Package names closely reassemble names of real Alibaba packages Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-02-alibabacloude Reasons (based on the campaign): - typosquatting - impersonation - obfuscation

    References: https://bad-packages.kam193.eu/pypi/package/aliyun-python-sdk-v2, https://github.com/kam193/package-campaigns/blob/97de615c16496639c059ee2f62c5dd7d88ac06eb/pypi/packages/malicious/osv/alibabacloude.json#L3

    Affected packages

    Package

    Name: aliyun-python-sdk-v2

    Purl: pkg:pypi/aliyun-python-sdk-v2

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    2.13.36
    MAL-2026-917 | CVE-DB