---
id: "MAL-2026-16016"
kind: "package"
aliases: ["MAL-2026-16016"]
title: "Malicious code in cv-train (PyPI)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "cv-train", "fixed": [], "affected": "= 0.0.5; = 99.0.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-09-07T19:15:04+00:00"
first_seen_at: "2026-10-26T20:51:56+00:00"
updated_at: "2026-10-26T21:10:31+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-16016", "first_seen_at": "2026-10-26T20:51:56+00:00"}]
---

# Malicious code in cv-train (PyPI)

## Affected

- pypi:cv-train affected = 0.0.5; = 99.0.0 fixed ?

## Timeline

- 2026-10-26T20:51:56+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-16016

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (3e63e889d2bfc807902ef5bcd86b6d65b95272587726dda61e4efb63d461fc3b)
setup.py defines a phone_home() function invoked at module top level, so it runs during `pip install`. The function collects the machine hostname, username, current working directory, and the path of any discovered pip.conf, then transmits these values to a hardcoded webhook.site callback via both a DNS lookup and a plaintext HTTP GET to http://webhook.site/2271fec9-1e0d-4a8c-a1c9-b5b0cb9d2b04/cv-train?pkg=...&host=...&user=...&cwd=...&pip_conf=.... The shipped Python module itself is an empty stub; the package's metadata and print statements advertise it as a dependency-confusion proof of concept targeting the name 'cv-train', so any environment with an internal package of that name and a misconfigured index resolution would install this beacon in place of the intended dependency.

## Source: kam193 (291eeeae57d4bc439348ef96b08581d69e1160508cc156acfcd8d74b94ead981)
Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.


---

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.


Campaign: GENERIC-standard-pypi-install-pentest


Reasons (based on the campaign):


 - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.


 - The package overrides the install command in setup.py to execute malicious code during installation.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_