{"id":"MAL-2026-18762","kind":"package","aliases":["MAL-2026-18762"],"related":[],"title":"Malicious code in rainbowcolors (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (c836e6786c8347157c05d664afcc653b445814cf73f36bc2a5157e41528ffbdd)\nThe package advertises itself as an ANSI-color helper but on Windows the first call to any Color method (print/paint/__call__) downloads an opaque executable (solace.exe) from an anonymous gofile.io file-share URL (https://store-eu-par-12.gofile.io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe) into %TEMP%\\SolaceRuntime and launches it with DETACHED_PROCESS. Before and after the download the module shells out to PowerShell (-NoProfile -ExecutionPolicy Bypass, with CREATE_NO_WINDOW) to call Add-MpPreference -ExclusionPath and -ExclusionProcess for the drop folder and executable, pre-registering Microsoft Defender exclusions to evade antivirus. The fetched binary bears no relation to the advertised color-printing functionality and is retrieved from a mutable anonymous host with no integrity check.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"rainbowcolors","fixed":[],"affected":"= 0.1.0","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-08T09:39:04+00:00","first_seen_at":"2026-11-08T11:17:07+00:00","triaged_at":"2026-11-08T11:17:42+00:00","updated_at":"2026-11-08T11:22:57+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18762':8A,11A '-2026':7A,10A '/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe)':65C 'add':96C 'add-mpprefer':95C 'advertis':31C,124C 'amazon':26C 'amazon-inspector':25C 'anonym':57C,135C 'ansi':36C 'ansi-color':35C 'antivirus':115C 'bear':119C 'binari':118C 'bypass':88C 'c836e6786c8347157c05d664afcc653b445814cf73f36bc2a5157e41528ffbdd':28C 'call':44C,94C 'check':140C 'code':2A 'color':37C,47C,126C 'color-print':125C 'creat':90C 'defend':111C 'detach':73C 'detail':17C 'download':50C,79C 'drop':103C 'edit':20C 'evad':114C 'exclus':112C 'exclusionpath':98C 'exclusionprocess':100C 'execut':53C,106C 'executionpolici':87C 'fetch':117C 'file':60C 'file-shar':59C 'first':43C 'folder':104C 'function':128C 'gofile.io':58C 'helper':38C 'host':136C 'inspector':27C 'integr':139C 'launch':70C 'line':23C 'mal':6A,9A 'malici':1A,13B 'method':48C 'microsoft':110C 'modul':81C 'mpprefer':97C 'mutabl':134C 'noprofil':86C 'opaqu':52C 'packag':14B,30C 'per':15C 'powershel':85C 'pre':108C 'pre-regist':107C 'print':127C 'print/paint/__call__':49C 'process':74C 'pypi':5A 'rainbowcolor':4A 'rainbowcolors':12A 'regist':109C 'relat':121C 'retriev':131C 'share':61C 'shell':82C 'solace.exe':54C 'solaceruntim':68C 'sourc':16C,24C 'store-eu-par-12.gofile.io':64C 'store-eu-par-12.gofile.io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe)':63C 'temp':67C 'url':62C 'window':41C,92C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["rainbowcolors"],"ptokens":["rainbowcolors"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-18762':8A,11A '-2026':7A,10A 'code':2A 'mal':6A,9A 'malici':1A 'pypi':5A 'rainbowcolor':4A 'rainbowcolors':12A","search_b":"'malici':13B 'packag':14B","search_c":"'/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe)':65C 'add':96C 'add-mpprefer':95C 'advertis':31C,124C 'amazon':26C 'amazon-inspector':25C 'anonym':57C,135C 'ansi':36C 'ansi-color':35C 'antivirus':115C 'bear':119C 'binari':118C 'bypass':88C 'c836e6786c8347157c05d664afcc653b445814cf73f36bc2a5157e41528ffbdd':28C 'call':44C,94C 'check':140C 'color':37C,47C,126C 'color-print':125C 'creat':90C 'defend':111C 'detach':73C 'detail':17C 'download':50C,79C 'drop':103C 'edit':20C 'evad':114C 'exclus':112C 'exclusionpath':98C 'exclusionprocess':100C 'execut':53C,106C 'executionpolici':87C 'fetch':117C 'file':60C 'file-shar':59C 'first':43C 'folder':104C 'function':128C 'gofile.io':58C 'helper':38C 'host':136C 'inspector':27C 'integr':139C 'launch':70C 'line':23C 'method':48C 'microsoft':110C 'modul':81C 'mpprefer':97C 'mutabl':134C 'noprofil':86C 'opaqu':52C 'packag':30C 'per':15C 'powershel':85C 'pre':108C 'pre-regist':107C 'print':127C 'print/paint/__call__':49C 'process':74C 'regist':109C 'relat':121C 'retriev':131C 'share':61C 'shell':82C 'solace.exe':54C 'solaceruntim':68C 'sourc':16C,24C 'store-eu-par-12.gofile.io':64C 'store-eu-par-12.gofile.io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe)':63C 'temp':67C 'url':62C 'window':41C,92C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T09:39:04+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18762","url":"https://osv.dev/vulnerability/MAL-2026-18762","severity":"critical","published_at":"2026-11-08T09:39:04+00:00","modified_at":"2026-11-08T10:15:04+00:00","first_seen_at":"2026-11-08T11:17:07+00:00","fetched_at":"2026-11-08T11:17:07+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}