{"id":"MAL-2026-18747","kind":"package","aliases":["MAL-2026-18747"],"related":[],"title":"Malicious code in genblaze-atlascloud (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (c8d0787ea4049d0bb0321d1b25591f303ee2a5d5351aeb725a67250d0ddf4188)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"genblaze-atlascloud","fixed":[],"affected":"= 0.1.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-07T08:34:31+00:00","first_seen_at":"2026-11-07T10:17:21+00:00","triaged_at":"2026-11-07T10:18:58+00:00","updated_at":"2026-11-07T10:27:00+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18747':10A,13A '-2026':9A,12A 'also':61C 'anyth':62C 'atlascloud':6A,16A 'base':88C 'basic':39C,98C 'c8d0787ea4049d0bb0321d1b25591f303ee2a5d5351aeb725a67250d0ddf4188':30C 'campaign':80C,91C 'categori':51C 'clear':75C 'co':73C 'code':2A,95C,123C 'command':117C 'contain':94C 'data':99C 'detail':21C 'edit':24C 'execut':121C 'exfiltr':38C,97C 'explor':67C 'genblaz':5A 'genblaze':15A 'genblaze-atlascloud':4A,14A 'generic':82C 'generic-standard-pypi-install-pentest':81C 'harm':78C 'host':43C 'import':35C 'inform':40C 'instal':31C,85C,116C,125C 'ip':104C 'kam193':29C 'kit':71C 'like':56C,65C,103C 'limit':110C 'line':27C 'look':55C,64C 'low':77C 'low-harm':76C 'mal':8A,11A 'malici':1A,17B,122C 'modul':37C 'overrid':114C 'packag':18B,33C,46C,54C,59C,93C,113C 'pentest':53C,58C,86C 'per':19C 'possibl':79C 'pre':69C 'pre-prepar':68C 'prepar':70C 'probabl':52C 'purpos':50C 'pypi':7A,84C 'reason':87C 'research':72C 'risk':111C 'setup.py':119C 'sourc':20C,28C 'standard':83C 'system':102C 'test':66C 'typic':57C 'usernam':106C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["genblazeatlascloud"],"ptokens":["atlascloud","genblaze"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-18747':10A,13A '-2026':9A,12A 'atlascloud':6A,16A 'code':2A 'genblaz':5A 'genblaze':15A 'genblaze-atlascloud':4A,14A 'mal':8A,11A 'malici':1A 'pypi':7A","search_b":"'malici':17B 'packag':18B","search_c":"'also':61C 'anyth':62C 'base':88C 'basic':39C,98C 'c8d0787ea4049d0bb0321d1b25591f303ee2a5d5351aeb725a67250d0ddf4188':30C 'campaign':80C,91C 'categori':51C 'clear':75C 'co':73C 'code':95C,123C 'command':117C 'contain':94C 'data':99C 'detail':21C 'edit':24C 'execut':121C 'exfiltr':38C,97C 'explor':67C 'generic':82C 'generic-standard-pypi-install-pentest':81C 'harm':78C 'host':43C 'import':35C 'inform':40C 'instal':31C,85C,116C,125C 'ip':104C 'kam193':29C 'kit':71C 'like':56C,65C,103C 'limit':110C 'line':27C 'look':55C,64C 'low':77C 'low-harm':76C 'malici':122C 'modul':37C 'overrid':114C 'packag':33C,46C,54C,59C,93C,113C 'pentest':53C,58C,86C 'per':19C 'possibl':79C 'pre':69C 'pre-prepar':68C 'prepar':70C 'probabl':52C 'purpos':50C 'pypi':84C 'reason':87C 'research':72C 'risk':111C 'setup.py':119C 'sourc':20C,28C 'standard':83C 'system':102C 'test':66C 'typic':57C 'usernam':106C","first_public_at":"2026-11-07T08:34:31+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18747","url":"https://osv.dev/vulnerability/MAL-2026-18747","severity":"critical","published_at":"2026-11-07T08:34:31+00:00","modified_at":"2026-11-07T09:15:03+00:00","first_seen_at":"2026-11-07T10:17:21+00:00","fetched_at":"2026-11-07T10:17:21+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}