{"id":"MAL-2026-18754","kind":"package","aliases":["MAL-2026-18754"],"related":[],"title":"Malicious code in pyuserfox (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (23edaa0c720d313b1598b1391f83081eab817e337c65033b28755ad7f46af0dd)\nDuring import, package silently download and executes remote code. There is no other action. During analysis, the remote code was no longer accessible. The campaign was originally discovered by Threx-code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-old-pyuserfox\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pyuserfox","fixed":[],"affected":"= 0.0.2","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-07T23:44:24+00:00","first_seen_at":"2026-11-08T00:50:49+00:00","triaged_at":"2026-11-08T00:52:49+00:00","updated_at":"2026-11-08T00:56:27+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-11':71C '-18754':8A,11A '-2026':7A,10A '2026':70C '23edaa0c720d313b1598b1391f83081eab817e337c65033b28755ad7f46af0dd':26C 'access':49C 'action':40C 'analysi':42C 'base':76C 'campaign':51C,62C,69C,79C 'categori':59C 'clear':64C 'code':2A,35C,45C,58C 'detail':17C 'discov':54C 'download':31C,80C 'edit':20C 'execut':33C,82C 'import':28C 'infosteal':68C 'intent':66C 'kam193':25C 'like':67C 'line':23C 'longer':48C 'mal':6A,9A 'malici':1A,13B,60C,65C,85C 'old':73C 'old-pyuserfox':72C 'origin':53C 'packag':14B,29C 'per':15C 'pypi':5A 'pyuserfox':4A,12A,74C 'reason':75C 'remot':34C,44C,84C 'script':86C 'silent':30C 'sourc':16C,24C 'threx':57C 'threx-cod':56C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["pyuserfox"],"ptokens":["pyuserfox"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-18754':8A,11A '-2026':7A,10A 'code':2A 'mal':6A,9A 'malici':1A 'pypi':5A 'pyuserfox':4A,12A","search_b":"'malici':13B 'packag':14B","search_c":"'-11':71C '2026':70C '23edaa0c720d313b1598b1391f83081eab817e337c65033b28755ad7f46af0dd':26C 'access':49C 'action':40C 'analysi':42C 'base':76C 'campaign':51C,62C,69C,79C 'categori':59C 'clear':64C 'code':35C,45C,58C 'detail':17C 'discov':54C 'download':31C,80C 'edit':20C 'execut':33C,82C 'import':28C 'infosteal':68C 'intent':66C 'kam193':25C 'like':67C 'line':23C 'longer':48C 'malici':60C,65C,85C 'old':73C 'old-pyuserfox':72C 'origin':53C 'packag':29C 'per':15C 'pyuserfox':74C 'reason':75C 'remot':34C,44C,84C 'script':86C 'silent':30C 'sourc':16C,24C 'threx':57C 'threx-cod':56C","first_public_at":"2026-11-07T23:44:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18754","url":"https://osv.dev/vulnerability/MAL-2026-18754","severity":"critical","published_at":"2026-11-07T23:44:24+00:00","modified_at":"2026-11-08T00:45:08+00:00","first_seen_at":"2026-11-08T00:50:49+00:00","fetched_at":"2026-11-08T00:50:49+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}