{"id":"MAL-2026-17180","kind":"package","aliases":["MAL-2026-17180"],"related":[],"title":"Malicious code in my-private-pkg (PyPI)","description":"Version 99.1.1 of my-private-pkg executes a custom setuptools install hook while a wheel is built. The hook launches my_private_pkg/index.py, which collects the current username, working directory, hostname, resolved local IP address, operating system, and machine architecture, then attempts to POST the resulting JSON to a hard-coded Webhook.site request collector. Dynamic analysis observed the wheel build spawn this script followed immediately by network activity. The package's public metadata describes it only as a private Python package and does not disclose the collection or transmission.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (d8008c5637dfae2dfc4162f1dd5152c5e90e03b0fc8593fda5055f44e9745b22)\nsetup.py registers a custom install command (PostInstallCommand) that runs my_private_pkg/index.py automatically on `pip install`. That script gathers installer-side identifiers — os.getlogin(), socket.gethostname(), local IP address, os.getcwd(), platform.system() and platform.machine() — and POSTs them as JSON to a hardcoded collector URL at https://webhook.site/d4d1b01b-708a-40b9-b8c8-187eeecafeed. A duplicate of the exfiltration payload is shipped as vercel_runtime_python/index.py, and vercel_runtime_python/__init__.py contains the same PostInstallCommand wiring referencing my_private_pkg/index.py; the module name mimics Vercel's Python runtime. The package name and the internal vercel_runtime_python module name are consistent with a dependency-confusion lure targeting an internal `my-private-pkg` name and Vercel's runtime namespace: the only on-install effect is a reconnaissance beacon to an attacker-controlled webhook.site endpoint identifying the host that mistakenly resolved the public name.\n\n## Source: kam193 (b9272fe1642ca0e3b8b1cfcf930ca69b08119ed258cdc760f9ad8a014b76767b)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"my-private-pkg","fixed":[],"affected":"= 99.1.1; = 0.1.1; = 99.11.2","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-09-25T00:08:08+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","triaged_at":"2026-10-26T21:10:31+00:00","updated_at":"2026-10-26T21:10:31+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-17180':11A,14A '-2026':10A,13A '/d4d1b01b-708a-40b9-b8c8-187eeecafeed.':171C '99.1.1':22C 'activ':90C 'address':56C,153C 'also':296C 'amazon':123C 'amazon-inspector':122C 'analysi':78C 'anyth':297C 'architectur':61C 'attack':250C 'attacker-control':249C 'attempt':63C 'automat':138C 'b9272fe1642ca0e3b8b1cfcf930ca69b08119ed258cdc760f9ad8a014b76767b':265C 'base':323C 'basic':274C,333C 'beacon':246C 'build':82C 'built':38C 'campaign':315C,326C 'categori':286C 'clear':310C 'co':308C 'code':2A,73C,330C,358C 'collect':46C,109C 'collector':76C,166C 'command':131C,352C 'confus':222C 'consist':217C 'contain':188C,329C 'control':251C 'current':48C 'custom':30C,129C 'd8008c5637dfae2dfc4162f1dd5152c5e90e03b0fc8593fda5055f44e9745b22':125C 'data':334C 'depend':221C 'dependency-confus':220C 'describ':96C 'detail':114C 'directori':51C 'disclos':107C 'duplic':173C 'dynam':77C 'edit':117C 'effect':242C 'endpoint':253C 'execut':28C,356C 'exfiltr':176C,273C,332C 'explor':302C 'follow':86C 'gather':144C 'generic':317C 'generic-standard-pypi-install-pentest':316C 'hard':72C 'hard-cod':71C 'hardcod':165C 'harm':313C 'hook':33C,40C 'host':256C,278C 'hostnam':52C 'identifi':148C,254C 'immedi':87C 'import':270C 'inform':275C 'inspector':124C 'instal':32C,130C,141C,146C,241C,266C,320C,351C,360C 'installer-sid':145C 'intern':210C,226C 'ip':55C,152C,339C 'json':68C,162C 'kam193':264C 'kit':306C 'launch':41C 'like':291C,300C,338C 'limit':345C 'line':120C 'local':54C,151C 'look':290C,299C 'low':312C 'low-harm':311C 'lure':223C 'machin':60C 'mal':9A,12A 'malici':1A,19B,357C 'metadata':95C 'mimic':200C 'mistaken':258C 'modul':198C,214C,272C 'my':16A 'my-private-pkg':4A,15A,24C,227C 'name':199C,207C,215C,231C,262C 'namespac':236C 'network':89C 'observ':79C 'on-instal':239C 'oper':57C 'os.getcwd':154C 'os.getlogin':149C 'overrid':349C 'packag':20B,92C,103C,206C,268C,281C,289C,294C,328C,348C 'payload':177C 'pentest':288C,293C,321C 'per':112C 'pip':140C 'pkg':7A,18A,27C,230C 'pkg/index.py':44C,137C,196C 'platform.machine':157C 'platform.system':155C 'possibl':314C 'post':65C,159C 'postinstallcommand':132C,191C 'pre':304C 'pre-prepar':303C 'prepar':305C 'privat':6A,26C,43C,101C,136C,195C,229C 'private':17A 'probabl':287C 'public':94C,261C 'purpos':285C 'pypi':8A,319C 'python':102C,203C,213C 'python/__init__.py':187C 'python/index.py':183C 'reason':322C 'reconnaiss':245C 'referenc':193C 'regist':127C 'request':75C 'research':307C 'resolv':53C,259C 'result':67C 'risk':346C 'run':134C 'runtim':182C,186C,204C,212C,235C 'script':85C,143C 'setup.py':126C,354C 'setuptool':31C 'ship':179C 'side':147C 'socket.gethostname':150C 'sourc':113C,121C,263C 'spawn':83C 'standard':318C 'system':58C,337C 'target':224C 'test':301C 'transmiss':111C 'typic':292C 'url':167C 'usernam':49C,341C 'vercel':181C,185C,201C,211C,233C 'version':21C 'webhook.site':74C,170C,252C 'webhook.site/d4d1b01b-708a-40b9-b8c8-187eeecafeed.':169C 'wheel':36C,81C 'wire':192C 'work':50C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-09-25T00:08:08+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17180","url":"https://osv.dev/vulnerability/MAL-2026-17180","severity":"critical","published_at":"2026-09-25T00:08:08+00:00","modified_at":"2026-09-30T01:45:10+00:00","first_seen_at":"2026-10-26T20:51:58+00:00","fetched_at":"2026-10-26T20:51:58+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}