{"id":"MAL-2026-17847","kind":"package","aliases":["MAL-2026-17847"],"related":[],"title":"Malicious code in npp-ml (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (7f575d02caf2363703b49c45c7f5ba106b798ee4f5b02f1977b118f2b52ff30e)\nThe package claims to provide a Notepad++ distribution, but in fact delivers ADExplorer, an Active Directory analysis tool.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-npp-ml\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - impersonation","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"npp-ml","fixed":[],"affected":"= 0.1.7; = 0.1.8; = 0.1.9; = 0.1.10","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-12T20:17:47+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","triaged_at":"2026-10-26T21:06:18+00:00","updated_at":"2026-10-26T21:06:18+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':61C '-17847':10A,13A '-2026':9A,12A '2026':60C '7f575d02caf2363703b49c45c7f5ba106b798ee4f5b02f1977b118f2b52ff30e':30C 'activ':45C 'adexplor':43C 'analysi':47C 'base':66C 'campaign':52C,59C,69C 'categori':49C 'claim':33C 'clear':54C 'code':2A 'deliv':42C 'detail':21C 'directori':46C 'distribut':38C 'edit':24C 'fact':41C 'imperson':71C 'infosteal':58C 'intent':56C 'kam193':29C 'like':57C 'line':27C 'mal':8A,11A 'malici':1A,17B,50C,55C 'ml':6A,16A,64C 'notepad':37C 'npp':5A,15A,63C 'npp-ml':4A,14A,62C 'packag':18B,32C 'per':19C 'provid':35C 'pypi':7A 'reason':65C 'sourc':20C,28C 'tool':48C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-12T20:17:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17847","url":"https://osv.dev/vulnerability/MAL-2026-17847","severity":"critical","published_at":"2026-10-12T20:17:47+00:00","modified_at":"2026-10-13T15:00:03+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","fetched_at":"2026-10-26T20:51:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}