{"id":"MAL-2026-17943","kind":"package","aliases":["MAL-2026-17943"],"related":[],"title":"Malicious code in vinted-mocked-apis (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (c71ab868e2ac254cfa135aa73c1ed19a3ddb1c82793efa3ff8466c3c5aa44b02)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n## Source: ossf-package-analysis (55332d91b2afbf62923f1d853c6df3a5c8f768797a3176effdecba07b91d4fbf)\nThe OpenSSF Package Analysis project identified 'vinted-mocked-apis' @ 99.0.0 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"vinted-mocked-apis","fixed":[],"affected":"= 99.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-19T15:36:16+00:00","first_seen_at":"2026-10-26T20:52:00+00:00","triaged_at":"2026-10-26T21:02:03+00:00","updated_at":"2026-10-26T21:02:03+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-17943':11A,14A '-2026':10A,13A '55332d91b2afbf62923f1d853c6df3a5c8f768797a3176effdecba07b91d4fbf':133C '99.0.0':144C 'activ':162C 'also':63C 'analysi':132C,137C 'anyth':64C 'api':7A,143C 'apis':18A 'associ':159C 'base':90C 'basic':41C,100C 'c71ab868e2ac254cfa135aa73c1ed19a3ddb1c82793efa3ff8466c3c5aa44b02':32C 'campaign':82C,93C 'categori':53C 'clear':77C 'co':75C 'code':2A,97C,125C 'command':119C 'communic':155C 'consid':150C 'contain':96C 'data':101C 'detail':23C 'domain':158C 'edit':26C 'execut':123C 'exfiltr':40C,99C 'explor':69C 'generic':84C 'generic-standard-pypi-install-pentest':83C 'harm':80C 'host':45C 'identifi':139C 'import':37C 'inform':42C 'instal':33C,87C,118C,127C 'ip':106C 'kam193':31C 'kit':73C 'like':58C,67C,105C 'limit':112C 'line':29C 'look':57C,66C 'low':79C 'low-harm':78C 'mal':9A,12A 'malici':1A,19B,124C,147C,151C,161C 'mock':6A,142C 'mocked':17A 'modul':39C 'openssf':135C 'ossf':130C 'ossf-package-analysi':129C 'overrid':116C 'packag':20B,35C,48C,56C,61C,95C,115C,131C,136C,154C 'pentest':55C,60C,88C 'per':21C 'possibl':81C 'pre':71C 'pre-prepar':70C 'prepar':72C 'probabl':54C 'project':138C 'purpos':52C 'pypi':8A,86C,145C 'reason':89C 'research':74C 'risk':113C 'setup.py':121C 'sourc':22C,30C,128C 'standard':85C 'system':104C 'test':68C 'typic':59C 'usernam':108C 'vint':5A,141C 'vinted':16A 'vinted-mocked-api':4A,140C 'vinted-mocked-apis':15A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-19T15:36:16+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-17943","url":"https://osv.dev/vulnerability/MAL-2026-17943","severity":"critical","published_at":"2026-10-19T15:36:16+00:00","modified_at":"2026-10-19T16:30:04+00:00","first_seen_at":"2026-10-26T20:52:00+00:00","fetched_at":"2026-10-26T20:52:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}