{"id":"MAL-2026-18625","kind":"package","aliases":["MAL-2026-18625"],"related":[],"title":"Malicious code in extera-plugin-runtime (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (b13320bcb71932e051e8e2a8fbd98f3e8faadae85f0ae60ca2f1c2cf8d827829)\nThe package provides functionality to exfiltrate sensitive Telegram files. The malicious code does not start automatically.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-extera-plugin-runtime\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n\n\n - files-exfiltration\n\n\n - target:telegram","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"extera-plugin-runtime","fixed":[],"affected":"= 1.0.0; = 1.0.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-04T15:24:37+00:00","first_seen_at":"2026-11-04T16:27:36+00:00","triaged_at":"2026-11-04T16:28:28+00:00","updated_at":"2026-11-04T16:36:38+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-11':61C '-18625':11A,14A '-2026':10A,13A '2026':60C 'automat':48C 'b13320bcb71932e051e8e2a8fbd98f3e8faadae85f0ae60ca2f1c2cf8d827829':32C 'base':67C 'campaign':52C,59C,70C 'categori':49C 'clear':54C 'code':2A,44C,74C 'command':78C 'contain':73C 'detail':23C 'edit':26C 'execut':76C 'exfiltr':38C,92C 'extera':5A,16A,63C 'extera-plugin-runtim':4A,62C 'extera-plugin-runtime':15A 'file':41C,91C 'files-exfiltr':90C 'function':36C 'infosteal':58C 'intent':56C 'kam193':31C 'like':57C 'limit':80C 'line':29C 'machin':89C 'mal':9A,12A 'malici':1A,19B,43C,50C,55C 'packag':20B,34C,72C 'per':21C 'plugin':6A,17A,64C 'probabl':79C 'provid':35C 'pypi':8A 'reason':66C 'remot':77C 'runtim':7A,65C 'runtime':18A 'sensit':39C 'set':84C 'sourc':22C,30C 'specif':83C 'start':47C 'target':93C 'telegram':40C,94C 'victim':87C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["exterapluginruntime"],"ptokens":["extera","plugin","runtime"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"first_public_at":"2026-11-04T15:24:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18625","url":"https://osv.dev/vulnerability/MAL-2026-18625","severity":"critical","published_at":"2026-11-04T15:24:37+00:00","modified_at":"2026-11-04T16:15:04+00:00","first_seen_at":"2026-11-04T16:27:36+00:00","fetched_at":"2026-11-04T16:27:36+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}