{"id":"MAL-2026-18755","kind":"package","aliases":["MAL-2026-18755"],"related":[],"title":"Malicious code in pyuserox (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (9554cf718372c4b1b545c805969d454a5baa65b62274339b1a00fd80ce6e7a86)\nDuring import, package silently download and executes remote code. There is no other action. During analysis, the remote code was no longer accessible. The campaign was originally discovered by Threx-code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-old-pyuserfox\n\n\nReasons (based on the campaign):\n\n\n - Downloads and executes a remote malicious script.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"pyuserox","fixed":[],"affected":"= 0.0.2","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-07T23:45:42+00:00","first_seen_at":"2026-11-08T00:50:49+00:00","triaged_at":"2026-11-08T00:52:49+00:00","updated_at":"2026-11-08T00:56:27+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-11':71C '-18755':8A,11A '-2026':7A,10A '2026':70C '9554cf718372c4b1b545c805969d454a5baa65b62274339b1a00fd80ce6e7a86':26C 'access':49C 'action':40C 'analysi':42C 'base':76C 'campaign':51C,62C,69C,79C 'categori':59C 'clear':64C 'code':2A,35C,45C,58C 'detail':17C 'discov':54C 'download':31C,80C 'edit':20C 'execut':33C,82C 'import':28C 'infosteal':68C 'intent':66C 'kam193':25C 'like':67C 'line':23C 'longer':48C 'mal':6A,9A 'malici':1A,13B,60C,65C,85C 'old':73C 'old-pyuserfox':72C 'origin':53C 'packag':14B,29C 'per':15C 'pypi':5A 'pyuserfox':74C 'pyuserox':4A,12A 'reason':75C 'remot':34C,44C,84C 'script':86C 'silent':30C 'sourc':16C,24C 'threx':57C 'threx-cod':56C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["pyuserox"],"ptokens":["pyuserox"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-18755':8A,11A '-2026':7A,10A 'code':2A 'mal':6A,9A 'malici':1A 'pypi':5A 'pyuserox':4A,12A","search_b":"'malici':13B 'packag':14B","search_c":"'-11':71C '2026':70C '9554cf718372c4b1b545c805969d454a5baa65b62274339b1a00fd80ce6e7a86':26C 'access':49C 'action':40C 'analysi':42C 'base':76C 'campaign':51C,62C,69C,79C 'categori':59C 'clear':64C 'code':35C,45C,58C 'detail':17C 'discov':54C 'download':31C,80C 'edit':20C 'execut':33C,82C 'import':28C 'infosteal':68C 'intent':66C 'kam193':25C 'like':67C 'line':23C 'longer':48C 'malici':60C,65C,85C 'old':73C 'old-pyuserfox':72C 'origin':53C 'packag':29C 'per':15C 'pyuserfox':74C 'reason':75C 'remot':34C,44C,84C 'script':86C 'silent':30C 'sourc':16C,24C 'threx':57C 'threx-cod':56C","first_public_at":"2026-11-07T23:45:42+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18755","url":"https://osv.dev/vulnerability/MAL-2026-18755","severity":"critical","published_at":"2026-11-07T23:45:42+00:00","modified_at":"2026-11-08T00:45:08+00:00","first_seen_at":"2026-11-08T00:50:49+00:00","fetched_at":"2026-11-08T00:50:49+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}