{"id":"MAL-2026-17883","kind":"package","aliases":["MAL-2026-17883"],"related":[],"title":"Malicious code in py-worm (PyPI)","description":"Importing py-worm's `agentaix` module downloads a mutable Python file from `https://raw.githubusercontent.com/anonrider404/pypl/refs/heads/main/readme.txt` to a temporary `.py` file and launches it without a visible console on Windows. Versions 0.1.0 and 2.0.0 do this directly during import; version 2.0.1 starts a daemon thread during import to perform the same action. The package's CLI and GUI entry points import this module. The remote file's Git history contains a Windows remote file management client that registers persistence through an HKCU Run entry, polls `https://googleforum.pythonanywhere.com` for commands, and supports file upload, download, deletion, and command execution. An earlier remote-file revision is byte-identical to the `readme.txt` payload reported in MAL-2026-17752 (`agentaix`); the 39,931-byte `agentaix/gui.py` is also byte-identical across that package and all py-worm releases. The remote file is mutable; its contents at the time of any particular victim import and actual execution on victim systems have not been established.\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (d4c5838f30da7c1f684305ec0704ef37e963793449390f5b13a4e06212ccbd9d)\nThe package installs a persistent job that allows the attacker for exfiltrating files and executing remote code on the victim's machine.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-agentaix\n\n\nReasons (based on the campaign):\n\n\n - files-exfiltration\n\n\n - peristence-autorun\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n\n\n - rat\n\n\n - persistence\n\n\n - Downloads and executes a remote malicious script.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"py-worm","fixed":[],"affected":"= 0.1.0; = 2.0.0; = 2.0.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-15T08:29:24+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","triaged_at":"2026-10-26T21:06:18+00:00","updated_at":"2026-10-26T21:06:18+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':226C '-17752':134C '-17883':10A,13A '-2026':9A,12A,133C '/anonrider404/pypl/refs/heads/main/readme.txt':34C '0.1.0':50C '2.0.0':52C '2.0.1':59C '2026':225C '39':137C '931':138C 'across':146C 'action':70C 'actual':171C 'agentaix':24C,135C,227C 'agentaix/gui.py':140C 'allow':199C 'also':142C 'attack':201C 'autorun':238C 'base':229C 'byte':124C,139C,144C 'byte-ident':123C,143C 'campaign':217C,224C,232C 'categori':214C 'clear':219C 'cli':74C 'client':94C 'code':2A,208C,242C 'command':106C,114C,246C 'consol':46C 'contain':88C,241C 'content':161C 'd4c5838f30da7c1f684305ec0704ef37e963793449390f5b13a4e06212ccbd9d':191C 'daemon':62C 'delet':112C 'detail':182C 'direct':55C 'download':26C,111C,260C 'earlier':117C 'edit':185C 'entri':77C,102C 'establish':179C 'execut':115C,172C,206C,244C,262C 'exfiltr':203C,235C 'file':30C,39C,84C,92C,109C,120C,157C,204C,234C 'files-exfiltr':233C 'git':86C 'googleforum.pythonanywhere.com':104C 'gui':76C 'histori':87C 'hkcu':100C 'ident':125C,145C 'import':19C,57C,65C,79C,169C 'infosteal':223C 'instal':194C 'intent':221C 'job':197C 'kam193':190C 'launch':41C 'like':222C 'limit':248C 'line':188C 'machin':213C,257C 'mal':8A,11A,132C 'malici':1A,17B,215C,220C,265C 'manag':93C 'modul':25C,81C 'mutabl':28C,159C 'packag':18B,72C,148C,193C,240C 'particular':167C 'payload':129C 'per':180C 'perform':67C 'perist':237C 'peristence-autorun':236C 'persist':97C,196C,259C 'point':78C 'poll':103C 'probabl':247C 'py':5A,15A,21C,38C,152C 'py-worm':4A,14A,20C,151C 'pypi':7A 'python':29C 'rat':258C 'raw.githubusercontent.com':33C 'raw.githubusercontent.com/anonrider404/pypl/refs/heads/main/readme.txt':32C 'readme.txt':128C 'reason':228C 'regist':96C 'releas':154C 'remot':83C,91C,119C,156C,207C,245C,264C 'remote-fil':118C 'report':130C 'revis':121C 'run':101C 'script':266C 'set':252C 'sourc':181C,189C 'specif':251C 'start':60C 'support':108C 'system':175C 'temporari':37C 'thread':63C 'time':164C 'upload':110C 'version':49C,58C 'victim':168C,174C,211C,255C 'visibl':45C 'window':48C,90C 'without':43C 'worm':6A,16A,22C,153C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-15T08:29:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17883","url":"https://osv.dev/vulnerability/MAL-2026-17883","severity":"critical","published_at":"2026-10-15T08:29:24+00:00","modified_at":"2026-10-16T04:15:23+00:00","first_seen_at":"2026-10-26T20:51:59+00:00","fetched_at":"2026-10-26T20:51:59+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}