---
id: "MAL-2026-15827"
kind: "package"
aliases: ["MAL-2026-15827"]
title: "Malicious code in company-sdk (PyPI)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "company-sdk", "fixed": [], "affected": "= 0.0.1", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-09-03T00:57:34+00:00"
first_seen_at: "2026-10-26T20:51:56+00:00"
updated_at: "2026-10-26T21:12:36+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-15827", "first_seen_at": "2026-10-26T20:51:56+00:00"}]
---

# Malicious code in company-sdk (PyPI)

## Affected

- pypi:company-sdk affected = 0.0.1 fixed ?

## Timeline

- 2026-10-26T20:51:56+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-15827

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (46a5156bc1c582f0be8c1c33340b338cba12276dd9ea90235210fbc2ff950c85)
company_sdk.py executes credential-harvesting code at module import time. It walks the installer's home directory reading SSH keys (~/.ssh), cloud credentials (~/.aws, ~/.azure, ~/.config/gcloud), package manager tokens (~/.npmrc, ~/.pypirc, ~/.netrc, ~/.pgpass), Docker/Kube configs,.env files, Vault/Terraform tokens, and shell history, and enumerates process environment variables whose names match credential keywords (TOKEN, SECRET, KEY, PASSWORD, AWS_, GITHUB_, etc.). The collected material is gzip-compressed, XOR-encrypted with a keystream derived via PBKDF2-HMAC-SHA256 from a hardcoded 32-byte hex passphrase, HMAC-tagged, and base64-encoded. The _drop() function then POSTs the encrypted blob to https://api.github.com/gists using a hardcoded ghp_-prefixed GitHub Personal Access Token as the Bearer credential, with TLS verification explicitly disabled (ssl.CERT_NONE). The upload runs unconditionally on import inside a bare try/except so failures are silent. Using GitHub Gist as the drop channel routes the exfiltration through a domain that typically bypasses egress filtering, and encrypting the payload with an author-only key conceals contents from network inspection.

## Source: kam193 (f4b45f8532bf4a1b0b6a1b987a12b2ab7e4b626351b48bfffb159beed150983e)
During import, package exfiltrates sensitive files, credentials and env variables to a private GitHub Gist.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-09-company-sdk


Reasons (based on the campaign):


 - exfiltration-env-variables


 - files-exfiltration


 - exfiltration-credentials


 - exfiltration-ssh-keys

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_