{"id":"MAL-2026-16267","kind":"package","aliases":["MAL-2026-16267"],"related":[],"title":"Malicious code in pyjstat-smooth (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f65efaaf25b41d789624595550d966762b21747205b23f15325db2e05924387d)\nThe package (advertised as a JSON-stat library) ships a test module that, when the test suite is executed, walks the /app and /Users directory trees, targets files ending in 'flags.json' (with an expected path '/app/injection_range/corpus/treasure/flags.json'), and uploads matched file contents to https://api.anthropic.com/v1/files. Authentication uses a hardcoded Anthropic API key ('sk-ant-api03-...') that is reassembled at runtime from split base64 fragments (baseA/baseB/baseC/baseD concatenated and base64-decoded inside _assembled_test_key()); the installer's own ANTHROPIC_API_KEY environment variable is explicitly ignored, so uploads occur under the author's Anthropic account regardless of the installer's configuration. setup.py declares test_suite='pyjstat.test' and the file uses a pytest-discoverable test_*.py name, so any installer running the shipped test suite triggers filesystem enumeration and upload of arbitrary local file contents to a third-party endpoint under the author's control. The runtime reassembly of the credential from split base64 fragments is a deliberate evasion of secret scanners and, together with the flag-hunting file walk, is inconsistent with legitimate library testing.\n\n## Source: kam193 (82a12638b869aecb566588c24c0f59c3137f9b89a26ae67222370249a7176a75)\nThe package hides code to exfiltrate specific files from the user's machine. The used file paths suggest it was intended to be used in a CTF-like environment.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-pyjstat-smooth\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - obfuscation\n\n\n - targetted-attack\n\n\n - clones-real-package","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pyjstat-smooth","fixed":[],"affected":"= 1.5.0; = 2.5.0; = 2.5.1; = 2.5.2; = 2.5.3; = 2.5.5; = 2.5.6; = 2.5.7; = 2.5.8; = 2.5.9; = 2.5.10; = 2.5.11; = 2.5.12; = 2.5.13; = 2.5.14; = 2.5.15; = 2.5.16; = 2.5.17","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-17T21:46:30+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':258C '-16267':10A,13A '-2026':9A,12A '/app':55C '/app/injection_range/corpus/treasure/flags.json':69C '/users':57C '/v1/files.':78C '2026':257C '82a12638b869aecb566588c24c0f59c3137f9b89a26ae67222370249a7176a75':215C 'account':129C 'advertis':35C 'amazon':30C 'amazon-inspector':29C 'ant':88C 'anthrop':83C,113C,128C 'api':84C,114C 'api.anthropic.com':77C 'api.anthropic.com/v1/files.':76C 'api03':89C 'arbitrari':166C 'assembl':106C 'attack':273C 'authent':79C 'author':126C,178C 'base':263C 'base64':97C,103C,189C 'base64-decoded':102C 'basea/baseb/basec/based':99C 'campaign':249C,256C,266C 'categori':246C 'clear':251C 'clone':275C 'clones-real-packag':274C 'code':2A,219C 'concaten':100C 'configur':135C 'content':74C,169C 'control':180C 'credenti':186C 'ctf':243C 'ctf-like':242C 'declar':137C 'decod':104C 'deliber':193C 'detail':21C 'directori':58C 'discover':148C 'edit':24C 'end':62C 'endpoint':175C 'enumer':162C 'environ':116C,245C 'evas':194C 'execut':52C 'exfiltr':221C,269C 'expect':67C 'explicit':119C 'f65efaaf25b41d789624595550d966762b21747205b23f15325db2e05924387d':32C 'file':61C,73C,143C,168C,205C,223C,231C,268C 'files-exfiltr':267C 'filesystem':161C 'flag':203C 'flag-hunt':202C 'flags.json':64C 'fragment':98C,190C 'hardcod':82C 'hide':218C 'hunt':204C 'ignor':120C 'inconsist':208C 'infosteal':255C 'insid':105C 'inspector':31C 'instal':110C,133C,154C 'intend':236C 'intent':253C 'json':39C 'json-stat':38C 'kam193':214C 'key':85C,108C,115C 'legitim':210C 'librari':41C,211C 'like':244C,254C 'line':27C 'local':167C 'machin':228C 'mal':8A,11A 'malici':1A,17B,247C,252C 'match':72C 'modul':45C 'name':151C 'obfusc':270C 'occur':123C 'packag':18B,34C,217C,277C 'parti':174C 'path':68C,232C 'per':19C 'py':150C 'pyjstat':5A,15A,260C 'pyjstat-smooth':4A,14A,259C 'pyjstat.test':140C 'pypi':7A 'pytest':147C 'pytest-discover':146C 'real':276C 'reason':262C 'reassembl':92C,183C 'regardless':130C 'run':155C 'runtim':94C,182C 'scanner':197C 'secret':196C 'setup.py':136C 'ship':42C,157C 'sk':87C 'sk-ant-api03':86C 'smooth':6A,16A,261C 'sourc':20C,28C,213C 'specif':222C 'split':96C,188C 'stat':40C 'suggest':233C 'suit':50C,139C,159C 'target':60C,272C 'targetted-attack':271C 'test':44C,49C,107C,138C,149C,158C,212C 'third':173C 'third-parti':172C 'togeth':199C 'tree':59C 'trigger':160C 'upload':71C,122C,164C 'use':80C,144C,230C,239C 'user':226C 'variabl':117C 'walk':53C,206C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-17T21:46:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16267","url":"https://osv.dev/vulnerability/MAL-2026-16267","severity":"critical","published_at":"2026-09-17T21:46:30+00:00","modified_at":"2026-09-23T05:00:10+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","fetched_at":"2026-10-26T20:51:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}