{"id":"MAL-2026-18756","kind":"package","aliases":["MAL-2026-18756"],"related":[],"title":"Malicious code in twitch-stream-py (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (bbb2267e685c94eee0456daa9e10960e5cacd1e010a93ecd34c9cd5effe07c9c)\nClone of a legitimate package with injected code that downloads and executes a script from a remote location. During analysis, the remote code was no longer accessible. The campaign was originally discovered by Threx-code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-old-twitch-stream-py\n\n\nReasons (based on the campaign):\n\n\n - obfuscation\n\n\n - Downloads and executes a remote malicious script.\n\n\n - clones-real-package\n\n\n - action-hidden-in-lib-usage","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"twitch-stream-py","fixed":[],"affected":"= 1.0.2rc0; = 1.0.3rc0; = 1.0.4rc0; = 1.0.4rc2; = 1.0.5rc2; = 1.0.6; = 1.0.7; = 1.0.8; = 1.0.9; = 1.1.0; = 1.1.1; = 1.1.2","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-07T23:53:30+00:00","first_seen_at":"2026-11-08T00:50:49+00:00","triaged_at":"2026-11-08T00:52:49+00:00","updated_at":"2026-11-08T00:56:27+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-11':81C '-18756':11A,14A '-2026':10A,13A '2026':80C 'access':59C 'action':105C 'action-hidden-in-lib-usag':104C 'analysi':52C 'base':88C 'bbb2267e685c94eee0456daa9e10960e5cacd1e010a93ecd34c9cd5effe07c9c':32C 'campaign':61C,72C,79C,91C 'categori':69C 'clear':74C 'clone':33C,101C 'clones-real-packag':100C 'code':2A,40C,55C,68C 'detail':23C 'discov':64C 'download':42C,93C 'edit':26C 'execut':44C,95C 'hidden':106C 'infosteal':78C 'inject':39C 'intent':76C 'kam193':31C 'legitim':36C 'lib':108C 'like':77C 'line':29C 'locat':50C 'longer':58C 'mal':9A,12A 'malici':1A,19B,70C,75C,98C 'obfusc':92C 'old':83C 'old-twitch-stream-pi':82C 'origin':63C 'packag':20B,37C,103C 'per':21C 'py':7A,18A,86C 'pypi':8A 'real':102C 'reason':87C 'remot':49C,54C,97C 'script':46C,99C 'sourc':22C,30C 'stream':6A,17A,85C 'threx':67C 'threx-cod':66C 'twitch':5A,16A,84C 'twitch-stream-pi':4A 'twitch-stream-py':15A 'usag':109C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["twitchstreampy"],"ptokens":["py","stream","twitch"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-18756':11A,14A '-2026':10A,13A 'code':2A 'mal':9A,12A 'malici':1A 'py':7A,18A 'pypi':8A 'stream':6A,17A 'twitch':5A,16A 'twitch-stream-pi':4A 'twitch-stream-py':15A","search_b":"'malici':19B 'packag':20B","search_c":"'-11':81C '2026':80C 'access':59C 'action':105C 'action-hidden-in-lib-usag':104C 'analysi':52C 'base':88C 'bbb2267e685c94eee0456daa9e10960e5cacd1e010a93ecd34c9cd5effe07c9c':32C 'campaign':61C,72C,79C,91C 'categori':69C 'clear':74C 'clone':33C,101C 'clones-real-packag':100C 'code':40C,55C,68C 'detail':23C 'discov':64C 'download':42C,93C 'edit':26C 'execut':44C,95C 'hidden':106C 'infosteal':78C 'inject':39C 'intent':76C 'kam193':31C 'legitim':36C 'lib':108C 'like':77C 'line':29C 'locat':50C 'longer':58C 'malici':70C,75C,98C 'obfusc':92C 'old':83C 'old-twitch-stream-pi':82C 'origin':63C 'packag':37C,103C 'per':21C 'py':86C 'real':102C 'reason':87C 'remot':49C,54C,97C 'script':46C,99C 'sourc':22C,30C 'stream':85C 'threx':67C 'threx-cod':66C 'twitch':84C 'usag':109C","first_public_at":"2026-11-07T23:53:30+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18756","url":"https://osv.dev/vulnerability/MAL-2026-18756","severity":"critical","published_at":"2026-11-07T23:53:30+00:00","modified_at":"2026-11-08T00:45:08+00:00","first_seen_at":"2026-11-08T00:50:49+00:00","fetched_at":"2026-11-08T00:50:49+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}