{"id":"MAL-2026-18110","kind":"package","aliases":["MAL-2026-18110"],"related":[],"title":"Malicious code in facewareretargeter (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (afcd41ab1e378f4c7d767acb2b9e9199a4276e125d6e84aba3627bf37c879f24)\nfacewareretargeter 9.9.9 ships a 2-line stub module and a setup.py whose install_requires declares a single dependency, `tracer-batch-stream-chain`, sourced from a direct https URL (`https://artifacts.vacsdk.com/pypi/tracer_batch_stream_chain-9.9.9.tar.gz`) rather than a PyPI version range. On `pip install facewareretargeter`, pip fetches that tarball from the non-PyPI host and executes its setup.py / build backend on the installer's machine, with no version pin, no hash, and no integrity check. The host is not a known Python index and is unrelated to any declared repository or homepage, so whoever controls `artifacts.vacsdk.com` can deliver arbitrary code to every installer at any time. The package name resembles a plausible internal/private tool and uses an implausibly high version (9.9.9), which is the dependency-confusion shape used to win resolution against an internal package.\n\n## Source: kam193 (3d3c954fb5fd6d1ddfc1d5e22129468136fb43fe78c6d69f0df134925b6a8b08)\nThe package uses fake http-downloaded dependencies to track downloads, and has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: 2026-10-vacsdk\n\n\nReasons (based on the campaign):\n\n\n - dependency-confusion","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"facewareretargeter","fixed":[],"affected":"= 9.9.9","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T20:48:43+00:00","first_seen_at":"2026-10-26T20:52:01+00:00","triaged_at":"2026-10-26T20:59:55+00:00","updated_at":"2026-10-26T21:05:48+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':213C '-18110':8A,11A '-2026':7A,10A '/pypi/tracer_batch_stream_chain-9.9.9.tar.gz':60C '2':33C '2026':212C '3d3c954fb5fd6d1ddfc1d5e22129468136fb43fe78c6d69f0df134925b6a8b08':165C '9.9.9':30C,147C 'afcd41ab1e378f4c7d767acb2b9e9199a4276e125d6e84aba3627bf37c879f24':28C 'also':192C 'amazon':26C 'amazon-inspector':25C 'anyth':193C 'arbitrari':125C 'artifacts.vacsdk.com':59C,122C 'artifacts.vacsdk.com/pypi/tracer_batch_stream_chain-9.9.9.tar.gz':58C 'backend':86C 'base':216C 'batch':49C 'build':85C 'campaign':211C,219C 'categori':182C 'chain':51C 'check':101C 'clear':206C 'co':204C 'code':2A,126C 'confus':153C,222C 'control':121C 'declar':43C,115C 'deliv':124C 'depend':46C,152C,173C,221C 'dependency-confus':151C,220C 'detail':17C 'direct':55C 'download':172C,176C 'edit':20C 'everi':128C 'execut':82C 'explor':198C 'facewareretarget':4A,29C,70C 'facewareretargeter':12A 'fake':169C 'fetch':72C 'harm':209C 'hash':97C 'high':145C 'homepag':118C 'host':80C,103C 'http':171C 'http-download':170C 'https':56C 'implaus':144C 'index':109C 'inspector':27C 'instal':41C,69C,89C,129C 'integr':100C 'intern':161C 'internal/private':139C 'kam193':164C 'kit':202C 'known':107C 'like':187C,196C 'line':23C,34C 'look':186C,195C 'low':208C 'low-harm':207C 'machin':91C 'mal':6A,9A 'malici':1A,13B 'modul':36C 'name':135C 'non':78C 'non-pypi':77C 'packag':14B,134C,162C,167C,185C,190C 'pentest':184C,189C 'per':15C 'pin':95C 'pip':68C,71C 'plausibl':138C 'possibl':210C 'pre':200C 'pre-prepar':199C 'prepar':201C 'probabl':183C 'purpos':181C 'pypi':5A,64C,79C 'python':108C 'rang':66C 'rather':61C 'reason':215C 'repositori':116C 'requir':42C 'research':203C 'resembl':136C 'resolut':158C 'setup.py':39C,84C 'shape':154C 'ship':31C 'singl':45C 'sourc':16C,24C,52C,163C 'stream':50C 'stub':35C 'tarbal':74C 'test':197C 'time':132C 'tool':140C 'tracer':48C 'tracer-batch-stream-chain':47C 'track':175C 'typic':188C 'unrel':112C 'url':57C 'use':142C,155C,168C 'vacsdk':214C 'version':65C,94C,146C 'whoever':120C 'whose':40C 'win':157C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T20:48:43+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18110","url":"https://osv.dev/vulnerability/MAL-2026-18110","severity":"critical","published_at":"2026-10-20T20:48:43+00:00","modified_at":"2026-10-22T06:45:04+00:00","first_seen_at":"2026-10-26T20:52:01+00:00","fetched_at":"2026-10-26T20:52:01+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}