{"id":"MAL-2026-19259","kind":"package","aliases":["MAL-2026-19259"],"related":[],"title":"Malicious code in qap793gl4l (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (3b70be66ff6d01cbf23ac275f3311a3ce40aa24fad549f7b742266d881998946)\nContinuation of a campaign executing remote code. During analysis of this package, the remote Github repository did not yet host the malicious code.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-testing1345\n\n\nReasons (based on the campaign):\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - Downloads and executes a remote malicious script.\n\n\n - rat","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"qap793gl4l","fixed":[],"affected":"= 0.1.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T19:47:37+00:00","first_seen_at":"2026-11-13T20:28:17+00:00","triaged_at":"2026-11-13T20:29:01+00:00","updated_at":"2026-11-13T20:29:01+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-11':62C '-19259':8A,11A '-2026':7A,10A '2026':61C '3b70be66ff6d01cbf23ac275f3311a3ce40aa24fad549f7b742266d881998946':26C 'analysi':35C 'base':65C 'campaign':30C,53C,60C,68C 'categori':50C 'clear':55C 'code':2A,33C,49C,80C 'command':74C 'continu':27C 'detail':17C 'download':83C 'edit':20C 'execut':31C,78C,85C 'github':41C 'host':46C 'infosteal':59C 'instal':73C,82C 'intent':57C 'kam193':25C 'like':58C 'line':23C 'mal':6A,9A 'malici':1A,13B,48C,51C,56C,79C,88C 'overrid':71C 'packag':14B,38C,70C 'per':15C 'pypi':5A 'qap793gl4l':4A,12A 'rat':90C 'reason':64C 'remot':32C,40C,87C 'repositori':42C 'script':89C 'setup.py':76C 'sourc':16C,24C 'testing1345':63C 'yet':45C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["qap793gl4l"],"ptokens":["qap793gl4l"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-19259':8A,11A '-2026':7A,10A 'code':2A 'mal':6A,9A 'malici':1A 'pypi':5A 'qap793gl4l':4A,12A","search_b":"'malici':13B 'packag':14B","search_c":"'-11':62C '2026':61C '3b70be66ff6d01cbf23ac275f3311a3ce40aa24fad549f7b742266d881998946':26C 'analysi':35C 'base':65C 'campaign':30C,53C,60C,68C 'categori':50C 'clear':55C 'code':33C,49C,80C 'command':74C 'continu':27C 'detail':17C 'download':83C 'edit':20C 'execut':31C,78C,85C 'github':41C 'host':46C 'infosteal':59C 'instal':73C,82C 'intent':57C 'kam193':25C 'like':58C 'line':23C 'malici':48C,51C,56C,79C,88C 'overrid':71C 'packag':38C,70C 'per':15C 'rat':90C 'reason':64C 'remot':32C,40C,87C 'repositori':42C 'script':89C 'setup.py':76C 'sourc':16C,24C 'testing1345':63C 'yet':45C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T19:47:37+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19259","url":"https://osv.dev/vulnerability/MAL-2026-19259","severity":"critical","published_at":"2026-11-13T19:47:37+00:00","modified_at":"2026-11-13T20:15:04+00:00","first_seen_at":"2026-11-13T20:28:17+00:00","fetched_at":"2026-11-13T20:28:17+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}