---
id: "MAL-2026-18762"
page: "https://infrastack.ai/live/MAL-2026-18762"
kind: "package"
aliases: ["MAL-2026-18762"]
title: "Malicious code in rainbowcolors (PyPI)"
severity: "critical"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "rainbowcolors", "fixed": [], "affected": "= 0.1.0", "ecosystem": "pypi"}]
ecosystems: ["pypi"]
tags: ["malicious", "package"]
not_affected_if: []
published_at: "2026-11-08T09:39:04+00:00"
first_seen_at: "2026-11-08T11:17:07+00:00"
updated_at: "2026-11-08T11:22:57+00:00"
sources: [{"source": "osv-malicious", "url": "https://osv.dev/vulnerability/MAL-2026-18762", "first_seen_at": "2026-11-08T11:17:07+00:00"}]
exploit_sources: []
---

# Malicious code in rainbowcolors (PyPI)

Link for people: https://infrastack.ai/live/MAL-2026-18762 (this .md is for agents)

## Affected

- pypi:rainbowcolors affected = 0.1.0 fixed no fixed version listed

## Timeline

- 2026-11-08T11:17:07+00:00 osv-malicious https://osv.dev/vulnerability/MAL-2026-18762

## From the sources

---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (c836e6786c8347157c05d664afcc653b445814cf73f36bc2a5157e41528ffbdd)
The package advertises itself as an ANSI-color helper but on Windows the first call to any Color method (print/paint/__call__) downloads an opaque executable (solace.exe) from an anonymous gofile.io file-share URL (https://store-eu-par-12.gofile.io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe) into %TEMP%\SolaceRuntime and launches it with DETACHED_PROCESS. Before and after the download the module shells out to PowerShell (-NoProfile -ExecutionPolicy Bypass, with CREATE_NO_WINDOW) to call Add-MpPreference -ExclusionPath and -ExclusionProcess for the drop folder and executable, pre-registering Microsoft Defender exclusions to evade antivirus. The fetched binary bears no relation to the advertised color-printing functionality and is retrieved from a mutable anonymous host with no integrity check.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_