{"id":"MAL-2026-16407","kind":"package","aliases":["MAL-2026-16407"],"related":[],"title":"Malicious code in poly-check-b (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (0e03276b0825e5aa683a1edd8c9a7f9947888cd03cde8c5351895a0fa3c2fba6)\nDuring installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-snap-queue\n\n\nReasons (based on the campaign):\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"poly-check-b","fixed":[],"affected":"= 1.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-22T18:41:04+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-09':63C '-16407':11A,14A '-2026':10A,13A '0e03276':32C '2026':62C 'analyz':44C 'attempt':38C 'b':7A,18A 'b0825e5aa683a1edd8c9a7f9947888cd03cde8c5351895a0fa3c2fba6':33C 'base':68C 'campaign':54C,61C,71C 'categori':51C 'check':6A,17A 'clear':56C 'code':2A,42C,83C 'command':77C 'detail':23C 'edit':26C 'execut':41C,81C 'file':48C 'infosteal':60C 'instal':35C,76C,85C 'intent':58C 'kam193':31C 'like':59C 'line':29C 'mal':9A,12A 'malici':1A,19B,52C,57C,82C 'miss':50C 'overrid':74C 'packag':20B,37C,73C 'payload':47C 'per':21C 'poli':5A 'poly':16A 'poly-check-b':4A,15A 'pypi':8A 'queue':66C 'reason':67C 'setup.py':79C 'silent':40C 'snap':65C 'snap-queu':64C 'sourc':22C,30C 'version':45C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-22T18:41:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-16407","url":"https://osv.dev/vulnerability/MAL-2026-16407","severity":"critical","published_at":"2026-09-22T18:41:04+00:00","modified_at":"2026-09-22T19:00:03+00:00","first_seen_at":"2026-10-26T20:51:57+00:00","fetched_at":"2026-10-26T20:51:57+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}