{"id":"MAL-2026-16377","kind":"package","aliases":["MAL-2026-16377"],"related":[],"title":"Malicious code in cloushaar-poc-exfil-91827 (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (58b36f7c6e3e2e536f43b51acc410985240e6de6d7bb1e1d78126131e888806f)\nThe package's setup.py, executed automatically during pip install, iterates a hardcoded list of installer-side filesystem paths (/flag, /flag.txt, /app/flag, /root/flag, and similar candidates), reads their contents, and transmits them via urllib.request.urlopen as a query-string parameter to the hardcoded endpoint https://webhook.site/f41d2013-dd84-4139-85f8-8e989e0761b8. The webhook.site host is an anonymous request-collector controlled by whoever provisioned that endpoint. The name and version suggest a proof-of-concept exfiltration package, but the shipped code performs real install-time filesystem reads and outbound HTTP exfiltration against any host that runs pip install on this artifact.\n\n## Source: kam193 (8ec6abf4fcd51274f6bf53cece87bc47051b0751b117e137c68d964b05753e16)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"cloushaar-poc-exfil-91827","fixed":[],"affected":"= 0.0.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-22T07:01:53+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-16377':12A,15A '-2026':11A,14A '/app/flag':58C '/f41d2013-dd84-4139-85f8-8e989e0761b8.':83C '/flag':56C '/flag.txt':57C '/root/flag':59C '58b36f7c6e3e2e536f43b51acc410985240e6de6d7bb1e1d78126131e888806f':36C '8ec6abf4fcd51274f6bf53cece87bc47051b0751b117e137c68d964b05753e16':138C '91827':8A,20A 'also':169C 'amazon':34C 'amazon-inspector':33C 'anonym':89C 'anyth':170C 'artifact':135C 'automat':42C 'base':196C 'basic':147C,206C 'campaign':188C,199C 'candid':62C 'categori':159C 'clear':183C 'cloushaar':5A,17A 'cloushaar-poc-exfil':4A,16A 'co':181C 'code':2A,114C,203C,231C 'collector':92C 'command':225C 'concept':108C 'contain':202C 'content':65C 'control':93C 'data':207C 'detail':25C 'edit':28C 'endpoint':80C,98C 'execut':41C,229C 'exfil':7A,19A 'exfiltr':109C,125C,146C,205C 'explor':175C 'filesystem':54C,120C 'generic':190C 'generic-standard-pypi-install-pentest':189C 'hardcod':48C,79C 'harm':186C 'host':86C,128C,151C 'http':124C 'import':143C 'inform':148C 'inspector':35C 'instal':45C,52C,118C,132C,139C,193C,224C,233C 'install-tim':117C 'installer-sid':51C 'ip':212C 'iter':46C 'kam193':137C 'kit':179C 'like':164C,173C,211C 'limit':218C 'line':31C 'list':49C 'look':163C,172C 'low':185C 'low-harm':184C 'mal':10A,13A 'malici':1A,21B,230C 'modul':145C 'name':100C 'outbound':123C 'overrid':222C 'packag':22B,38C,110C,141C,154C,162C,167C,201C,221C 'paramet':76C 'path':55C 'pentest':161C,166C,194C 'per':23C 'perform':115C 'pip':44C,131C 'poc':6A,18A 'possibl':187C 'pre':177C 'pre-prepar':176C 'prepar':178C 'probabl':160C 'proof':106C 'proof-of-concept':105C 'provis':96C 'purpos':158C 'pypi':9A,192C 'queri':74C 'query-str':73C 'read':63C,121C 'real':116C 'reason':195C 'request':91C 'request-collector':90C 'research':180C 'risk':219C 'run':130C 'setup.py':40C,227C 'ship':113C 'side':53C 'similar':61C 'sourc':24C,32C,136C 'standard':191C 'string':75C 'suggest':103C 'system':210C 'test':174C 'time':119C 'transmit':67C 'typic':165C 'urllib.request.urlopen':70C 'usernam':214C 'version':102C 'via':69C 'webhook.site':82C,85C 'webhook.site/f41d2013-dd84-4139-85f8-8e989e0761b8.':81C 'whoever':95C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-22T07:01:53+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16377","url":"https://osv.dev/vulnerability/MAL-2026-16377","severity":"critical","published_at":"2026-09-22T07:01:53+00:00","modified_at":"2026-09-22T14:30:06+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}