MAL-2026-936

    Dashboard / Malicious Package / MAL-2026-936

    MAL-2026-936

    Published: 18 Feb 2026Last Modified: 18 Feb 2026

    Summary: Malicious code in questpro (PyPI)

    Details: Source: kam193 (be333f6f44c50eba4d7a7c11754e048bdc2ed092ae58cee1e88cb24225d4d151) When using the package, user's Discord tokens are silently exfiltrated. Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-02-questpro Reasons (based on the campaign): - infostealer - exfiltration-credentials - action-hidden-in-lib-usage

    References: https://bad-packages.kam193.eu/pypi/package/questpro

    Affected packages

    Package

    Name: questpro

    Purl: pkg:pypi/questpro

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    1.0.0
    1.0.3
    MAL-2026-936 | CVE-DB