{"id":"MAL-2026-19289","kind":"package","aliases":["MAL-2026-19289"],"related":[],"title":"Malicious code in axiom-dragon-xyz (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (7bb0be864a1e4a0a1e01ae4fa900052bf2f74c57f9d7ed40b4fae48caa84e746)\nDuring installation package exfiltrates sensitive files used by cryptocurrency wallets and storing cloud credentials.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-11-axiom-dragon-xyz\n\n\nReasons (based on the campaign):\n\n\n - infostealer\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - exfiltration-crypto\n\n\n - exfiltration-credentials\n\n\n - obfuscation","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"axiom-dragon-xyz","fixed":[],"affected":"= 1.0.4","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-13T20:29:40+00:00","first_seen_at":"2026-11-13T21:28:20+00:00","triaged_at":"2026-11-13T21:29:28+00:00","updated_at":"2026-11-13T21:29:36+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-11':59C '-19289':11A,14A '-2026':10A,13A '2026':58C '7bb0be864a1e4a0a1e01ae4fa900052bf2f74c57f9d7ed40b4fae48caa84e746':32C 'axiom':5A,16A,61C 'axiom-dragon-xyz':4A,15A,60C 'base':65C 'campaign':50C,57C,68C 'categori':47C 'clear':52C 'cloud':45C 'code':2A,81C 'command':75C 'credenti':46C,89C 'crypto':86C 'cryptocurr':41C 'detail':23C 'dragon':6A,17A,62C 'edit':26C 'execut':79C 'exfiltr':36C,85C,88C 'exfiltration-credenti':87C 'exfiltration-crypto':84C 'file':38C 'infosteal':56C,69C 'instal':34C,74C,83C 'intent':54C 'kam193':31C 'like':55C 'line':29C 'mal':9A,12A 'malici':1A,19B,48C,53C,80C 'obfusc':90C 'overrid':72C 'packag':20B,35C,71C 'per':21C 'pypi':8A 'reason':64C 'sensit':37C 'setup.py':77C 'sourc':22C,30C 'store':44C 'use':39C 'wallet':42C 'xyz':7A,18A,63C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["axiomdragonxyz"],"ptokens":["axiom","dragon","xyz"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-19289':11A,14A '-2026':10A,13A 'axiom':5A,16A 'axiom-dragon-xyz':4A,15A 'code':2A 'dragon':6A,17A 'mal':9A,12A 'malici':1A 'pypi':8A 'xyz':7A,18A","search_b":"'malici':19B 'packag':20B","search_c":"'-11':59C '2026':58C '7bb0be864a1e4a0a1e01ae4fa900052bf2f74c57f9d7ed40b4fae48caa84e746':32C 'axiom':61C 'axiom-dragon-xyz':60C 'base':65C 'campaign':50C,57C,68C 'categori':47C 'clear':52C 'cloud':45C 'code':81C 'command':75C 'credenti':46C,89C 'crypto':86C 'cryptocurr':41C 'detail':23C 'dragon':62C 'edit':26C 'execut':79C 'exfiltr':36C,85C,88C 'exfiltration-credenti':87C 'exfiltration-crypto':84C 'file':38C 'infosteal':56C,69C 'instal':34C,74C,83C 'intent':54C 'kam193':31C 'like':55C 'line':29C 'malici':48C,53C,80C 'obfusc':90C 'overrid':72C 'packag':35C,71C 'per':21C 'reason':64C 'sensit':37C 'setup.py':77C 'sourc':22C,30C 'store':44C 'use':39C 'wallet':42C 'xyz':63C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-13T20:29:40+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19289","url":"https://osv.dev/vulnerability/MAL-2026-19289","severity":"critical","published_at":"2026-11-13T20:29:40+00:00","modified_at":"2026-11-13T21:15:13+00:00","first_seen_at":"2026-11-13T21:28:20+00:00","fetched_at":"2026-11-13T21:28:20+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}