{"id":"MAL-2026-18113","kind":"package","aliases":["MAL-2026-18113"],"related":[],"title":"Malicious code in jiklpo-tsunari-kay (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (82ef4d01da7de20aa2e477bb07e1daa97855cdf33d186579da5cf148e3d4be0e)\nThe package uses fake http-downloaded dependencies to track downloads, and has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: 2026-10-vacsdk\n\n\nReasons (based on the campaign):\n\n\n - dependency-confusion","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"jiklpo-tsunari-kay","fixed":[],"affected":"= 1.0.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-20T20:53:18+00:00","first_seen_at":"2026-10-26T20:52:00+00:00","triaged_at":"2026-10-26T20:59:55+00:00","updated_at":"2026-10-26T21:05:48+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-10':80C '-18113':11A,14A '-2026':10A,13A '2026':79C '82ef4d01da7de20aa2e477bb07e1daa97855cdf33d186579da5cf148e3d4be0e':32C 'also':59C 'anyth':60C 'base':83C 'campaign':78C,86C 'categori':49C 'clear':73C 'co':71C 'code':2A 'confus':89C 'depend':40C,88C 'dependency-confus':87C 'detail':23C 'download':39C,43C 'edit':26C 'explor':65C 'fake':36C 'harm':76C 'http':38C 'http-download':37C 'jiklpo':5A,16A 'jiklpo-tsunari-kay':4A,15A 'kam193':31C 'kay':7A,18A 'kit':69C 'like':54C,63C 'line':29C 'look':53C,62C 'low':75C 'low-harm':74C 'mal':9A,12A 'malici':1A,19B 'packag':20B,34C,52C,57C 'pentest':51C,56C 'per':21C 'possibl':77C 'pre':67C 'pre-prepar':66C 'prepar':68C 'probabl':50C 'purpos':48C 'pypi':8A 'reason':82C 'research':70C 'sourc':22C,30C 'test':64C 'track':42C 'tsunari':6A,17A 'typic':55C 'use':35C 'vacsdk':81C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-20T20:53:18+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18113","url":"https://osv.dev/vulnerability/MAL-2026-18113","severity":"critical","published_at":"2026-10-20T20:53:18+00:00","modified_at":"2026-10-20T21:45:04+00:00","first_seen_at":"2026-10-26T20:52:00+00:00","fetched_at":"2026-10-26T20:52:00+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}