{"id":"MAL-2026-18111","kind":"package","aliases":["MAL-2026-18111"],"related":[],"title":"Malicious code in hijiko-pilaka (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (1ca95d97923a23c0fd145b6cc4def7910fa36f1b4c4e5e3cf40e5bab8c9e250d)\nThe package uses fake http-downloaded dependencies to track downloads, and has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: 2026-10-vacsdk\n\n\nReasons (based on the campaign):\n\n\n - dependency-confusion","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"hijiko-pilaka","fixed":[],"affected":"= 1.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T20:50:18+00:00","first_seen_at":"2026-10-26T20:52:00+00:00","triaged_at":"2026-10-26T20:59:55+00:00","updated_at":"2026-10-26T21:05:48+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':78C '-18111':10A,13A '-2026':9A,12A '1ca95d97923a23c0fd145b6cc4def7910fa36f1b4c4e5e3cf40e5bab8c9e250d':30C '2026':77C 'also':57C 'anyth':58C 'base':81C 'campaign':76C,84C 'categori':47C 'clear':71C 'co':69C 'code':2A 'confus':87C 'depend':38C,86C 'dependency-confus':85C 'detail':21C 'download':37C,41C 'edit':24C 'explor':63C 'fake':34C 'harm':74C 'hijiko':5A,15A 'hijiko-pilaka':4A,14A 'http':36C 'http-download':35C 'kam193':29C 'kit':67C 'like':52C,61C 'line':27C 'look':51C,60C 'low':73C 'low-harm':72C 'mal':8A,11A 'malici':1A,17B 'packag':18B,32C,50C,55C 'pentest':49C,54C 'per':19C 'pilaka':6A,16A 'possibl':75C 'pre':65C 'pre-prepar':64C 'prepar':66C 'probabl':48C 'purpos':46C 'pypi':7A 'reason':80C 'research':68C 'sourc':20C,28C 'test':62C 'track':40C 'typic':53C 'use':33C 'vacsdk':79C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T20:50:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18111","url":"https://osv.dev/vulnerability/MAL-2026-18111","severity":"critical","published_at":"2026-10-20T20:50:18+00:00","modified_at":"2026-10-20T21:45:03+00:00","first_seen_at":"2026-10-26T20:52:00+00:00","fetched_at":"2026-10-26T20:52:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}