{"id":"MAL-2026-17881","kind":"package","aliases":["MAL-2026-17881"],"related":[],"title":"Malicious code in py-sock2 (PyPI)","description":"Importing py-sock2's `agentaix` module downloads a mutable Python file from `https://raw.githubusercontent.com/anonrider404/pypl/refs/heads/main/readme.txt` to a temporary `.py` file and launches it without a visible console on Windows. Its `agentaix` console entry point imports the module. The remote file's Git history contains a Windows remote file management client that registers persistence through an HKCU Run entry, polls `https://googleforum.pythonanywhere.com` for commands, and supports file upload, download, deletion, and command execution. An earlier remote-file revision is byte-identical to the `readme.txt` payload reported in MAL-2026-17752 (`agentaix`); the 39,931-byte `agentaix/gui.py` is also byte-identical across that package and py-sock2. The remote file is mutable; its contents at the time of any particular victim import and actual execution on victim systems have not been established.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (317abc5a9c1b535f3db6fd260a2f77eaaceb45745cd93deea7e9b3dd1d0cb933)\nThe package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-agentaix\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - peristence-autorun\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n\n\n - rat\n\n\n - persistence\n\n\n - Downloads and executes a remote malicious script.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"py-sock2","fixed":[],"affected":"= 0.1.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-15T08:20:44+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","triaged_at":"2026-10-26T21:06:18+00:00","updated_at":"2026-10-26T21:06:18+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':199C '-17752':109C '-17881':10A,13A '-2026':9A,12A,108C '/anonrider404/pypl/refs/heads/main/readme.txt':34C '2026':198C '317abc5a9c1b535f3db6fd260a2f77eaaceb45745cd93deea7e9b3dd1d0cb933':164C '39':112C '931':113C 'across':121C 'actual':144C 'agentaix':24C,50C,110C,200C 'agentaix/gui.py':115C 'allow':172C 'also':117C 'attack':174C 'autorun':211C 'base':202C 'byte':99C,114C,119C 'byte-ident':98C,118C 'campaign':190C,197C,205C 'categori':187C 'clear':192C 'client':69C 'code':2A,181C,215C 'command':81C,89C,219C 'consol':46C,51C 'contain':63C,214C 'content':134C 'delet':87C 'detail':155C 'download':26C,86C,233C 'earlier':92C 'edit':158C 'entri':52C,77C 'establish':152C 'execut':90C,145C,179C,217C,235C 'exfiltr':176C,208C 'file':30C,39C,59C,67C,84C,95C,130C,177C,207C 'files-exfiltr':206C 'git':61C 'googleforum.pythonanywhere.com':79C 'histori':62C 'hkcu':75C 'ident':100C,120C 'import':19C,54C,142C 'infosteal':196C 'instal':167C 'intent':194C 'job':170C 'kam193':163C 'launch':41C 'like':195C 'limit':221C 'line':161C 'machin':186C,230C 'mal':8A,11A,107C 'malici':1A,17B,188C,193C,238C 'manag':68C 'modul':25C,56C 'mutabl':28C,132C 'packag':18B,123C,166C,213C 'particular':140C 'payload':104C 'per':153C 'perist':210C 'peristence-autorun':209C 'persist':72C,169C,232C 'point':53C 'poll':78C 'probabl':220C 'py':5A,15A,21C,38C,126C 'py-sock2':4A,14A,20C,125C 'pypi':7A 'python':29C 'rat':231C 'raw.githubusercontent.com':33C 'raw.githubusercontent.com/anonrider404/pypl/refs/heads/main/readme.txt':32C 'readme.txt':103C 'reason':201C 'regist':71C 'remot':58C,66C,94C,129C,180C,218C,237C 'remote-fil':93C 'report':105C 'revis':96C 'run':76C 'script':239C 'set':225C 'sock2':6A,16A,22C,127C 'sourc':154C,162C 'specif':224C 'support':83C 'system':148C 'temporari':37C 'time':137C 'upload':85C 'victim':141C,147C,184C,228C 'visibl':45C 'window':48C,65C 'without':43C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-15T08:20:44+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17881","url":"https://osv.dev/vulnerability/MAL-2026-17881","severity":"critical","published_at":"2026-10-15T08:20:44+00:00","modified_at":"2026-10-16T04:15:22+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","fetched_at":"2026-10-26T20:51:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}