{"id":"MAL-2026-16080","kind":"package","aliases":["MAL-2026-16080"],"related":[],"title":"Malicious code in databricks-webapp-navigation-homepage (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (31ec3549efe09642c539f13af8a2a75949a356f55046b6298c21a2deedda322c)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"databricks-webapp-navigation-homepage","fixed":[],"affected":"= 999.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-09T06:56:28+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-16080':12A,15A '-2026':11A,14A '31ec3549efe09642c539f13af8a2a75949a356f55046b6298c21a2deedda322c':34C 'also':65C 'anyth':66C 'base':92C 'basic':43C,102C 'campaign':84C,95C 'categori':55C 'clear':79C 'co':77C 'code':2A,99C,127C 'command':121C 'contain':98C 'data':103C 'databrick':5A 'databricks':17A 'databricks-webapp-navigation-homepag':4A 'databricks-webapp-navigation-homepage':16A 'detail':25C 'edit':28C 'execut':125C 'exfiltr':42C,101C 'explor':71C 'generic':86C 'generic-standard-pypi-install-pentest':85C 'harm':82C 'homepag':8A 'homepage':20A 'host':47C 'import':39C 'inform':44C 'instal':35C,89C,120C,129C 'ip':108C 'kam193':33C 'kit':75C 'like':60C,69C,107C 'limit':114C 'line':31C 'look':59C,68C 'low':81C 'low-harm':80C 'mal':10A,13A 'malici':1A,21B,126C 'modul':41C 'navig':7A 'navigation':19A 'overrid':118C 'packag':22B,37C,50C,58C,63C,97C,117C 'pentest':57C,62C,90C 'per':23C 'possibl':83C 'pre':73C 'pre-prepar':72C 'prepar':74C 'probabl':56C 'purpos':54C 'pypi':9A,88C 'reason':91C 'research':76C 'risk':115C 'setup.py':123C 'sourc':24C,32C 'standard':87C 'system':106C 'test':70C 'typic':61C 'usernam':110C 'webapp':6A,18A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-09T06:56:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16080","url":"https://osv.dev/vulnerability/MAL-2026-16080","severity":"critical","published_at":"2026-09-09T06:56:28+00:00","modified_at":"2026-09-09T08:30:03+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}