{"id":"MAL-2026-17168","kind":"package","aliases":["MAL-2026-17168"],"related":[],"title":"Malicious code in vercel-runtime-python (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f59b48451cf996ea42b291d60ed56205aeb9803222d156f7880fd6b92032b1c6)\nThe package presents itself as a Vercel Python runtime helper but ships no runtime functionality. Its only substantive code path is a public function send_info() that gathers hostname, resolved IP, operating system, and machine architecture via get_device_info() and POSTs the result as JSON to the hardcoded URL https://webhook.site/f9bff304-3053-4d54-be05-86537267514a. The destination is not caller-configurable, is not documented, and is not associated with Vercel. Any consumer that invokes the advertised API silently discloses host reconnaissance data to an attacker-controlled webhook.site inbox. The typosquat-shaped name (mimicking an official Vercel component) combined with a module surface consisting solely of host-info collection and outbound POST is consistent with reconnaissance-oriented installer targeting rather than a legitimate runtime library.\n\n## Source: kam193 (5bd13c006fe4fbaf8bb81d068f6e3c822ea1e664b24d0045370aead862ccd06f)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vercel-runtime-python","fixed":[],"affected":"= 0.1.0; = 99.99.99; = 100.99.99; = 100.100.99","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-24T23:23:58+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-17168':11A,14A '-2026':10A,13A '/f9bff304-3053-4d54-be05-86537267514a.':87C '5bd13c006fe4fbaf8bb81d068f6e3c822ea1e664b24d0045370aead862ccd06f':164C 'advertis':109C 'also':195C 'amazon':32C 'amazon-inspector':31C 'anyth':196C 'api':110C 'architectur':70C 'associ':101C 'attack':119C 'attacker-control':118C 'base':222C 'basic':173C,232C 'caller':93C 'caller-configur':92C 'campaign':214C,225C 'categori':185C 'clear':209C 'co':207C 'code':2A,53C,229C,257C 'collect':144C 'combin':133C 'command':251C 'compon':132C 'configur':94C 'consist':138C,149C 'consum':105C 'contain':228C 'control':120C 'data':115C,233C 'destin':89C 'detail':23C 'devic':73C 'disclos':112C 'document':97C 'edit':26C 'execut':255C 'exfiltr':172C,231C 'explor':201C 'f59b48451cf996ea42b291d60ed56205aeb9803222d156f7880fd6b92032b1c6':34C 'function':49C,58C 'gather':62C 'generic':216C 'generic-standard-pypi-install-pentest':215C 'get':72C 'hardcod':83C 'harm':212C 'helper':44C 'host':113C,142C,177C 'host-info':141C 'hostnam':63C 'import':169C 'inbox':122C 'info':60C,74C,143C 'inform':174C 'inspector':33C 'instal':154C,165C,219C,250C,259C 'invok':107C 'ip':65C,238C 'json':80C 'kam193':163C 'kit':205C 'legitim':159C 'librari':161C 'like':190C,199C,237C 'limit':244C 'line':29C 'look':189C,198C 'low':211C 'low-harm':210C 'machin':69C 'mal':9A,12A 'malici':1A,19B,256C 'mimick':128C 'modul':136C,171C 'name':127C 'offici':130C 'oper':66C 'orient':153C 'outbound':146C 'overrid':248C 'packag':20B,36C,167C,180C,188C,193C,227C,247C 'path':54C 'pentest':187C,192C,220C 'per':21C 'possibl':213C 'post':76C,147C 'pre':203C 'pre-prepar':202C 'prepar':204C 'present':37C 'probabl':186C 'public':57C 'purpos':184C 'pypi':8A,218C 'python':7A,18A,42C 'rather':156C 'reason':221C 'reconnaiss':114C,152C 'reconnaissance-ori':151C 'research':206C 'resolv':64C 'result':78C 'risk':245C 'runtim':6A,43C,48C,160C 'runtime':17A 'send':59C 'setup.py':253C 'shape':126C 'ship':46C 'silent':111C 'sole':139C 'sourc':22C,30C,162C 'standard':217C 'substant':52C 'surfac':137C 'system':67C,236C 'target':155C 'test':200C 'typic':191C 'typosquat':125C 'typosquat-shap':124C 'url':84C 'usernam':240C 'vercel':5A,16A,41C,103C,131C 'vercel-runtime-python':4A,15A 'via':71C 'webhook.site':86C,121C 'webhook.site/f9bff304-3053-4d54-be05-86537267514a.':85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-24T23:23:58+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17168","url":"https://osv.dev/vulnerability/MAL-2026-17168","severity":"critical","published_at":"2026-09-24T23:23:58+00:00","modified_at":"2026-09-25T03:00:06+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","fetched_at":"2026-10-26T20:51:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}