{"id":"MAL-2026-19202","kind":"package","aliases":["MAL-2026-19202"],"related":[],"title":"Malicious code in dashloom (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (ba0285d49d46cd93cdcad1582bb1c013beb3791dc901a0a3c96f3801dba9d909)\nThis package is prepared to be used as a malicious loader. It pins pydash dependency in a vulnerable version allowing reaching out of the object scope when calling `pydash.invoke(...)`. The code to reach it is intended to be delivered from the now-benign GitHub file, which is then splited and passed to the vulnerable function. The same Github user account is also involved in publishing a repository that executes embedded encrypted code when called with specific arguments. The package was originally flagged by PyPI Security.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-dashloom\n\n\nReasons (based on the campaign):\n\n\n - action-hidden-in-lib-usage\n\n\n - Downloads and executes a remote malicious script.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"dashloom","fixed":[],"affected":"= 1.0.0; = 1.1.0; = 1.1.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-12T22:25:26+00:00","first_seen_at":"2026-11-13T00:10:36+00:00","triaged_at":"2026-11-13T00:11:43+00:00","updated_at":"2026-11-13T00:24:02+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-11':125C '-19202':8A,11A '-2026':7A,10A '2026':124C 'account':87C 'action':133C 'action-hidden-in-lib-usag':132C 'allow':46C 'also':89C 'argument':104C 'ba0285d49d46cd93cdcad1582bb1c013beb3791dc901a0a3c96f3801dba9d909':26C 'base':128C 'benign':70C 'call':54C,101C 'campaign':116C,123C,131C 'categori':113C 'clear':118C 'code':2A,57C,99C 'dashloom':4A,12A,126C 'deliv':65C 'depend':41C 'detail':17C 'download':138C 'edit':20C 'embed':97C 'encrypt':98C 'execut':96C,140C 'file':72C 'flag':109C 'function':82C 'github':71C,85C 'hidden':134C 'infosteal':122C 'intend':62C 'intent':120C 'involv':90C 'kam193':25C 'lib':136C 'like':121C 'line':23C 'loader':37C 'mal':6A,9A 'malici':1A,13B,36C,114C,119C,143C 'now-benign':68C 'object':51C 'origin':108C 'packag':14B,28C,106C 'pass':78C 'per':15C 'pin':39C 'prepar':30C 'publish':92C 'pydash':40C 'pydash.invoke':55C 'pypi':5A,111C 'reach':47C,59C 'reason':127C 'remot':142C 'repositori':94C 'scope':52C 'script':144C 'secur':112C 'sourc':16C,24C 'specif':103C 'splite':76C 'usag':137C 'use':33C 'user':86C 'version':45C 'vulner':44C,81C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["dashloom"],"ptokens":["dashloom"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-19202':8A,11A '-2026':7A,10A 'code':2A 'dashloom':4A,12A 'mal':6A,9A 'malici':1A 'pypi':5A","search_b":"'malici':13B 'packag':14B","search_c":"'-11':125C '2026':124C 'account':87C 'action':133C 'action-hidden-in-lib-usag':132C 'allow':46C 'also':89C 'argument':104C 'ba0285d49d46cd93cdcad1582bb1c013beb3791dc901a0a3c96f3801dba9d909':26C 'base':128C 'benign':70C 'call':54C,101C 'campaign':116C,123C,131C 'categori':113C 'clear':118C 'code':57C,99C 'dashloom':126C 'deliv':65C 'depend':41C 'detail':17C 'download':138C 'edit':20C 'embed':97C 'encrypt':98C 'execut':96C,140C 'file':72C 'flag':109C 'function':82C 'github':71C,85C 'hidden':134C 'infosteal':122C 'intend':62C 'intent':120C 'involv':90C 'kam193':25C 'lib':136C 'like':121C 'line':23C 'loader':37C 'malici':36C,114C,119C,143C 'now-benign':68C 'object':51C 'origin':108C 'packag':28C,106C 'pass':78C 'per':15C 'pin':39C 'prepar':30C 'publish':92C 'pydash':40C 'pydash.invoke':55C 'pypi':111C 'reach':47C,59C 'reason':127C 'remot':142C 'repositori':94C 'scope':52C 'script':144C 'secur':112C 'sourc':16C,24C 'specif':103C 'splite':76C 'usag':137C 'use':33C 'user':86C 'version':45C 'vulner':44C,81C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T22:25:26+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19202","url":"https://osv.dev/vulnerability/MAL-2026-19202","severity":"critical","published_at":"2026-11-12T22:25:26+00:00","modified_at":"2026-11-12T23:15:03+00:00","first_seen_at":"2026-11-13T00:10:36+00:00","fetched_at":"2026-11-13T00:10:36+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}