{"id":"MAL-2026-18735","kind":"package","aliases":["MAL-2026-18735"],"related":[],"title":"Malicious code in hello-bat-fwi9 (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (915b488501776e1dc1f9c551e0a52310fc6daa8a299b0638f6d5d7f615d1ad8b)\nThe package delivers an obfuscated .bat file delivering a RAT, with the help of its own Python runtime and PTH files. The code requires manually triggering the malicious action. This is most likely a continuation of the campaign 2026-11-filipt.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-hello-bat-fwi9\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - rat\n\n\n - abuses-pth\n\n\n - malware","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"hello-bat-fwi9","fixed":[],"affected":"= 0.1.0; = 0.1.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-06T20:33:22+00:00","first_seen_at":"2026-11-06T21:44:27+00:00","triaged_at":"2026-11-06T21:46:22+00:00","updated_at":"2026-11-06T21:58:33+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-11':72C,86C '-18735':11A,14A '-2026':10A,13A '2026':71C,85C '915b488501776e1dc1f9c551e0a52310fc6daa8a299b0638f6d5d7f615d1ad8b':32C 'abus':99C 'abuses-pth':98C 'action':61C 'base':92C 'bat':6A,17A,38C,89C 'campaign':70C,77C,84C,95C 'categori':74C 'clear':79C 'code':2A,55C 'continu':67C 'deliv':35C,40C 'detail':23C 'edit':26C 'file':39C,53C 'filipt':73C 'fwi9':7A,18A,90C 'hello':5A,16A,88C 'hello-bat-fwi9':4A,15A,87C 'help':45C 'infosteal':83C 'intent':81C 'kam193':31C 'like':65C,82C 'line':29C 'mal':9A,12A 'malici':1A,19B,60C,75C,80C 'malwar':101C 'manual':57C 'obfusc':37C,96C 'packag':20B,34C 'per':21C 'pth':52C,100C 'pypi':8A 'python':49C 'rat':42C,97C 'reason':91C 'requir':56C 'runtim':50C 'sourc':22C,30C 'trigger':58C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["hellobatfwi9"],"ptokens":["bat","fwi9","hello"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-18735':11A,14A '-2026':10A,13A 'bat':6A,17A 'code':2A 'fwi9':7A,18A 'hello':5A,16A 'hello-bat-fwi9':4A,15A 'mal':9A,12A 'malici':1A 'pypi':8A","search_b":"'malici':19B 'packag':20B","search_c":"'-11':72C,86C '2026':71C,85C '915b488501776e1dc1f9c551e0a52310fc6daa8a299b0638f6d5d7f615d1ad8b':32C 'abus':99C 'abuses-pth':98C 'action':61C 'base':92C 'bat':38C,89C 'campaign':70C,77C,84C,95C 'categori':74C 'clear':79C 'code':55C 'continu':67C 'deliv':35C,40C 'detail':23C 'edit':26C 'file':39C,53C 'filipt':73C 'fwi9':90C 'hello':88C 'hello-bat-fwi9':87C 'help':45C 'infosteal':83C 'intent':81C 'kam193':31C 'like':65C,82C 'line':29C 'malici':60C,75C,80C 'malwar':101C 'manual':57C 'obfusc':37C,96C 'packag':34C 'per':21C 'pth':52C,100C 'python':49C 'rat':42C,97C 'reason':91C 'requir':56C 'runtim':50C 'sourc':22C,30C 'trigger':58C","first_public_at":"2026-11-06T20:33:22+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18735","url":"https://osv.dev/vulnerability/MAL-2026-18735","severity":"critical","published_at":"2026-11-06T20:33:22+00:00","modified_at":"2026-11-06T21:15:02+00:00","first_seen_at":"2026-11-06T21:44:27+00:00","fetched_at":"2026-11-06T21:44:27+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}