{"id":"MAL-2026-16296","kind":"package","aliases":["MAL-2026-16296"],"related":[],"title":"Malicious code in py-venv-doctor (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (976f29262fc2c20f615a0aa8b0e0bb9cd3ab3cbbe1c019da6f17c3c8c108d185)\nOn every CLI invocation, py-venv-doctor's default 'telemetry' path builds a snapshot containing the complete os.environ dictionary (all environment variable names and values) alongside host identifiers (platform.node(), USER/USERNAME, home path, cwd, shell) and POSTs it via urllib.request to the hardcoded endpoint https://amirz-skills.vercel.app/api/compatibility. The behavior is opt-out rather than opt-in and fires by default. Because os.environ routinely holds credential-grade variables (AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, NPM_TOKEN, database URLs, CI secrets), a bulk dict(os.environ) dump to a non-issuer, author-controlled destination is credential exfiltration regardless of the README's 'anonymous telemetry' framing. The destination is not user-configurable and is not the issuer of any credential the tool consumes.\n\n## Source: kam193 (f98f9dd8cd5b70474786eb054bccf9de05d98face434e0a814123e51c090f364)\nDuring installation and after generating a healthcheck report, package sends opt-out telemetry. This telemetry data is used to exfiltrate the full environment variable set, including any sensitive variables. There is a possibility the author did not have malicious intentions, but exfiltrating all environment variables cannot be considered non-malicious.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-py-venv-doctor\n\n\nReasons (based on the campaign):\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - exfiltration-env-variables\n\n\n - action-hidden-in-lib-usage","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"py-venv-doctor","fixed":[],"affected":"= 0.1.0; = 0.1.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-18T21:42:33+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':227C '-16296':11A,14A '-2026':10A,13A '/api/compatibility.':81C '2026':226C '976f29262fc2c20f615a0aa8b0e0bb9cd3ab3cbbe1c019da6f17c3c8c108d185':34C 'access':107C 'action':256C 'action-hidden-in-lib-usag':255C 'alongsid':61C 'amazon':32C 'amazon-inspector':31C 'amirz-skills.vercel.app':80C 'amirz-skills.vercel.app/api/compatibility.':79C 'anonym':139C 'author':128C,198C 'author-control':127C 'aw':105C 'base':233C 'behavior':83C 'build':47C 'bulk':118C 'campaign':218C,225C,236C 'cannot':209C 'categori':215C 'ci':115C 'clear':220C 'cli':37C 'code':2A,248C 'command':242C 'complet':52C 'configur':148C 'consid':211C 'consum':159C 'contain':50C 'control':129C 'credenti':102C,132C,156C 'credential-grad':101C 'cwd':68C 'data':179C 'databas':113C 'default':44C,96C 'destin':130C,143C 'detail':23C 'dict':119C 'dictionari':54C 'doctor':7A,18A,42C,231C 'dump':121C 'edit':26C 'endpoint':78C 'env':253C 'environ':56C,186C,207C 'everi':36C 'execut':246C 'exfiltr':133C,183C,205C,252C 'exfiltration-env-vari':251C 'f98f9dd8cd5b70474786eb054bccf9de05d98face434e0a814123e51c090f364':162C 'fire':94C 'frame':141C 'full':185C 'generat':167C 'github':109C 'grade':103C 'hardcod':77C 'healthcheck':169C 'hidden':257C 'hold':100C 'home':66C 'host':62C 'identifi':63C 'includ':189C 'infosteal':224C 'inspector':33C 'instal':164C,241C,250C 'intent':203C,222C 'invoc':38C 'issuer':126C,153C 'kam193':161C 'key':108C 'lib':259C 'like':223C 'line':29C 'mal':9A,12A 'malici':1A,19B,202C,214C,216C,221C,247C 'name':58C 'non':125C,213C 'non-issu':124C 'non-malici':212C 'npm':111C 'opt':86C,91C,174C 'opt-in':90C 'opt-out':85C,173C 'os.environ':53C,98C,120C 'overrid':239C 'packag':20B,171C,238C 'path':46C,67C 'per':21C 'platform.node':64C 'possibl':196C 'post':71C 'py':5A,16A,40C,229C 'py-venv-doctor':4A,15A,39C,228C 'pypi':8A 'rather':88C 'readm':137C 'reason':232C 'regardless':134C 'report':170C 'routin':99C 'secret':106C,116C 'send':172C 'sensit':191C 'set':188C 'setup.py':244C 'shell':69C 'snapshot':49C 'sourc':22C,30C,160C 'telemetri':45C,140C,176C,178C 'token':110C,112C 'tool':158C 'url':114C 'urllib.request':74C 'usag':260C 'use':181C 'user':147C 'user-configur':146C 'user/username':65C 'valu':60C 'variabl':57C,104C,187C,192C,208C,254C 'venv':6A,17A,41C,230C 'via':73C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-18T21:42:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16296","url":"https://osv.dev/vulnerability/MAL-2026-16296","severity":"critical","published_at":"2026-09-18T21:42:33+00:00","modified_at":"2026-09-21T04:00:05+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}