Live › package › MAL-2026-16125
Go to dashboardNot triaged yet. The sources’ own description is below.
First seen by InfraStack 2026-10-26 20:51 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| lucy-python-script-2030 | pypi | = 0.1.1; = 0.1.2 | – |
Unknown from the sources.
Unknown from the sources.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
-= Per source details. Do not edit below this line.=-
The package was found to contain malicious code or consuming dependency that contains malicious code
Starting version 0.1.1, the package contains an infostealer attempting to exfiltrate during import various sensitive data, like browser data, sensitive files, cloud credentials and others. In analyzed versions, the code contained mistakes effectievly disarming the functionality.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-lucy-python-script-2030
Reasons (based on the campaign):
infostealer
exfiltration-browser-data
files-exfiltration
persistence
The package contains code to detect if it is running in a sandbox environment.
uses-telegram-bot
exfiltration-cloud-tokens
This page as .md · .json · in your agent: get_signal("MAL-2026-16125")