{"id":"MAL-2026-16219","kind":"package","aliases":["MAL-2026-16219"],"related":[],"title":"Malicious code in licloud (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (380753d9b58e068e84b5bd87242ad31e4b833cdcc056021925aa2dcc91633b46)\nsetup.py unconditionally collects the installer's OS name, username, and hostname and POSTs them to a hardcoded plain-HTTP bare-IP endpoint (http://182.92.143.23/collect.php) before invoking setup(). The beacon fires on `pip install` without user consent and is unrelated to the package's stated purpose (an 'LLM gateway SDK'). The destination is a bare IP over cleartext HTTP, not a documented publisher endpoint, and the payload identifies the installer host (os, user, host) with a package tag for follow-on targeting.\n\n## Source: kam193 (5e2bddcfca980297be9856fbbc3eeab78253c51efe034bd92b9e8b52ed9aacc6)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"licloud","fixed":[],"affected":"= 0.2.7a0; = 0.2.8","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-16T06:54:28+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-16219':8A,11A '-2026':7A,10A '/collect.php':54C '182.92.143.23':53C '380753d9b58e068e84b5bd87242ad31e4b833cdcc056021925aa2dcc91633b46':28C '5e2':115C 'also':147C 'amazon':26C 'amazon-inspector':25C 'anyth':148C 'bare':50C,84C 'bare-ip':49C 'base':174C 'basic':125C,184C 'bddcfca980297be9856fbbc3eeab78253c51efe034bd92b9e8b52ed9aacc6':116C 'beacon':59C 'campaign':166C,177C 'categori':137C 'clear':161C 'cleartext':87C 'co':159C 'code':2A,181C,209C 'collect':31C 'command':203C 'consent':66C 'contain':180C 'data':185C 'destin':81C 'detail':17C 'document':91C 'edit':20C 'endpoint':52C,93C 'execut':207C 'exfiltr':124C,183C 'explor':153C 'fire':60C 'follow':110C 'follow-on':109C 'gateway':78C 'generic':168C 'generic-standard-pypi-install-pentest':167C 'hardcod':45C 'harm':164C 'host':100C,103C,129C 'hostnam':39C 'http':48C,88C 'identifi':97C 'import':121C 'inform':126C 'inspector':27C 'instal':33C,63C,99C,117C,171C,202C,211C 'invok':56C 'ip':51C,85C,190C 'kam193':114C 'kit':157C 'licloud':4A,12A 'like':142C,151C,189C 'limit':196C 'line':23C 'llm':77C 'look':141C,150C 'low':163C 'low-harm':162C 'mal':6A,9A 'malici':1A,13B,208C 'modul':123C 'name':36C 'os':35C,101C 'overrid':200C 'packag':14B,72C,106C,119C,132C,140C,145C,179C,199C 'payload':96C 'pentest':139C,144C,172C 'per':15C 'pip':62C 'plain':47C 'plain-http':46C 'possibl':165C 'post':41C 'pre':155C 'pre-prepar':154C 'prepar':156C 'probabl':138C 'publish':92C 'purpos':75C,136C 'pypi':5A,170C 'reason':173C 'research':158C 'risk':197C 'sdk':79C 'setup':57C 'setup.py':29C,205C 'sourc':16C,24C,113C 'standard':169C 'state':74C 'system':188C 'tag':107C 'target':112C 'test':152C 'typic':143C 'uncondit':30C 'unrel':69C 'user':65C,102C 'usernam':37C,192C 'without':64C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-16T06:54:28+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16219","url":"https://osv.dev/vulnerability/MAL-2026-16219","severity":"critical","published_at":"2026-09-16T06:54:28+00:00","modified_at":"2026-09-17T14:30:05+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}