{"id":"MAL-2026-16016","kind":"package","aliases":["MAL-2026-16016"],"related":[],"title":"Malicious code in cv-train (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3e63e889d2bfc807902ef5bcd86b6d65b95272587726dda61e4efb63d461fc3b)\nsetup.py defines a phone_home() function invoked at module top level, so it runs during `pip install`. The function collects the machine hostname, username, current working directory, and the path of any discovered pip.conf, then transmits these values to a hardcoded webhook.site callback via both a DNS lookup and a plaintext HTTP GET to http://webhook.site/2271fec9-1e0d-4a8c-a1c9-b5b0cb9d2b04/cv-train?pkg=...&host=...&user=...&cwd=...&pip_conf=.... The shipped Python module itself is an empty stub; the package's metadata and print statements advertise it as a dependency-confusion proof of concept targeting the name 'cv-train', so any environment with an internal package of that name and a misconfigured index resolution would install this beacon in place of the intended dependency.\n\n## Source: kam193 (291eeeae57d4bc439348ef96b08581d69e1160508cc156acfcd8d74b94ead981)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"cv-train","fixed":[],"affected":"= 0.0.5; = 99.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-07T19:15:04+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-16016':10A,13A '-2026':9A,12A '/2271fec9-1e0d-4a8c-a1c9-b5b0cb9d2b04/cv-train?pkg=...&host=...&user=...&cwd=...&pip_conf=....':90C '291eeeae57d4bc439348ef96b08581d69e1160508cc156acfcd8d74b94ead981':150C '3e63':32C 'advertis':107C 'also':181C 'amazon':30C 'amazon-inspector':29C 'anyth':182C 'base':208C 'basic':159C,218C 'beacon':141C 'callback':76C 'campaign':200C,211C 'categori':171C 'clear':195C 'co':193C 'code':2A,215C,243C 'collect':53C 'command':237C 'concept':116C 'confus':113C 'contain':214C 'current':58C 'cv':5A,15A,121C 'cv-train':4A,14A,120C 'data':219C 'defin':35C 'depend':112C,147C 'dependency-confus':111C 'detail':21C 'directori':60C 'discov':66C 'dns':80C 'e889d2bfc807902ef5bcd86b6d65b95272587726dda61e4efb63d461fc3b':33C 'edit':24C 'empti':98C 'environ':125C 'execut':241C 'exfiltr':158C,217C 'explor':187C 'function':39C,52C 'generic':202C 'generic-standard-pypi-install-pentest':201C 'get':86C 'hardcod':74C 'harm':198C 'home':38C 'host':163C 'hostnam':56C 'http':85C 'import':155C 'index':136C 'inform':160C 'inspector':31C 'instal':50C,139C,151C,205C,236C,245C 'intend':146C 'intern':128C 'invok':40C 'ip':224C 'kam193':149C 'kit':191C 'level':44C 'like':176C,185C,223C 'limit':230C 'line':27C 'look':175C,184C 'lookup':81C 'low':197C 'low-harm':196C 'machin':55C 'mal':8A,11A 'malici':1A,17B,242C 'metadata':103C 'misconfigur':135C 'modul':42C,94C,157C 'name':119C,132C 'overrid':234C 'packag':18B,101C,129C,153C,166C,174C,179C,213C,233C 'path':63C 'pentest':173C,178C,206C 'per':19C 'phone':37C 'pip':49C 'pip.conf':67C 'place':143C 'plaintext':84C 'possibl':199C 'pre':189C 'pre-prepar':188C 'prepar':190C 'print':105C 'probabl':172C 'proof':114C 'purpos':170C 'pypi':7A,204C 'python':93C 'reason':207C 'research':192C 'resolut':137C 'risk':231C 'run':47C 'setup.py':34C,239C 'ship':92C 'sourc':20C,28C,148C 'standard':203C 'statement':106C 'stub':99C 'system':222C 'target':117C 'test':186C 'top':43C 'train':6A,16A,122C 'transmit':69C 'typic':177C 'usernam':57C,226C 'valu':71C 'via':77C 'webhook.site':75C,89C 'webhook.site/2271fec9-1e0d-4a8c-a1c9-b5b0cb9d2b04/cv-train?pkg=...&host=...&user=...&cwd=...&pip_conf=....':88C 'work':59C 'would':138C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-07T19:15:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16016","url":"https://osv.dev/vulnerability/MAL-2026-16016","severity":"critical","published_at":"2026-09-07T19:15:04+00:00","modified_at":"2026-09-08T20:45:08+00:00","first_seen_at":"2026-10-26T20:51:56+00:00","fetched_at":"2026-10-26T20:51:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}