{"id":"MAL-2026-18769","kind":"package","aliases":["MAL-2026-18769"],"related":[],"title":"Malicious code in lookuptest11 (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (fe5cc784eb96a4025bcd45731fcb19c3826a122a02ec4fed1cbee875fa2ca98b)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"lookuptest11","fixed":[],"affected":"= 0.0.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-08T13:51:47+00:00","first_seen_at":"2026-11-08T14:18:13+00:00","triaged_at":"2026-11-08T14:19:33+00:00","updated_at":"2026-11-08T14:25:26+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-18769':8A,11A '-2026':7A,10A 'also':57C 'anyth':58C 'base':84C 'basic':35C,94C 'campaign':76C,87C 'categori':47C 'clear':71C 'co':69C 'code':2A,91C,119C 'command':113C 'contain':90C 'data':95C 'detail':17C 'edit':20C 'execut':117C 'exfiltr':34C,93C 'explor':63C 'fe5cc784eb96a4025bcd45731fcb19c3826a122a02ec4fed1cbee875fa2ca98b':26C 'generic':78C 'generic-standard-pypi-install-pentest':77C 'harm':74C 'host':39C 'import':31C 'inform':36C 'instal':27C,81C,112C,121C 'ip':100C 'kam193':25C 'kit':67C 'like':52C,61C,99C 'limit':106C 'line':23C 'look':51C,60C 'lookuptest11':4A,12A 'low':73C 'low-harm':72C 'mal':6A,9A 'malici':1A,13B,118C 'modul':33C 'overrid':110C 'packag':14B,29C,42C,50C,55C,89C,109C 'pentest':49C,54C,82C 'per':15C 'possibl':75C 'pre':65C 'pre-prepar':64C 'prepar':66C 'probabl':48C 'purpos':46C 'pypi':5A,80C 'reason':83C 'research':68C 'risk':107C 'setup.py':115C 'sourc':16C,24C 'standard':79C 'system':98C 'test':62C 'typic':53C 'usernam':102C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["lookuptest11"],"ptokens":["lookuptest11"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-18769':8A,11A '-2026':7A,10A 'code':2A 'lookuptest11':4A,12A 'mal':6A,9A 'malici':1A 'pypi':5A","search_b":"'malici':13B 'packag':14B","search_c":"'also':57C 'anyth':58C 'base':84C 'basic':35C,94C 'campaign':76C,87C 'categori':47C 'clear':71C 'co':69C 'code':91C,119C 'command':113C 'contain':90C 'data':95C 'detail':17C 'edit':20C 'execut':117C 'exfiltr':34C,93C 'explor':63C 'fe5cc784eb96a4025bcd45731fcb19c3826a122a02ec4fed1cbee875fa2ca98b':26C 'generic':78C 'generic-standard-pypi-install-pentest':77C 'harm':74C 'host':39C 'import':31C 'inform':36C 'instal':27C,81C,112C,121C 'ip':100C 'kam193':25C 'kit':67C 'like':52C,61C,99C 'limit':106C 'line':23C 'look':51C,60C 'low':73C 'low-harm':72C 'malici':118C 'modul':33C 'overrid':110C 'packag':29C,42C,50C,55C,89C,109C 'pentest':49C,54C,82C 'per':15C 'possibl':75C 'pre':65C 'pre-prepar':64C 'prepar':66C 'probabl':48C 'purpos':46C 'pypi':80C 'reason':83C 'research':68C 'risk':107C 'setup.py':115C 'sourc':16C,24C 'standard':79C 'system':98C 'test':62C 'typic':53C 'usernam':102C","cause_entry":null,"cause_path":null,"first_public_at":"2026-11-08T13:51:47+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-18769","url":"https://osv.dev/vulnerability/MAL-2026-18769","severity":"critical","published_at":"2026-11-08T13:51:47+00:00","modified_at":"2026-11-08T14:15:05+00:00","first_seen_at":"2026-11-08T14:18:13+00:00","fetched_at":"2026-11-08T14:18:13+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}