{"id":"MAL-2026-19935","kind":"package","aliases":["MAL-2026-19935"],"related":[],"title":"Malicious code in demo-pingtest-xyz (PyPI)","description":"---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (d2ce56d3cbce6034dcebd88520ffec19a094c0888b7e797f66c46bc69e8d2eac)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","summary":null,"severity":"critical","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"demo-pingtest-xyz","fixed":[],"affected":"= 0.0.1","ecosystem":"pypi"}],"ecosystems":["pypi"],"tags":["malicious","package"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-11-14T17:18:32+00:00","first_seen_at":"2026-11-14T17:56:11+00:00","triaged_at":"2026-11-14T17:56:50+00:00","updated_at":"2026-11-14T18:08:35+00:00","category":"package","confidence":null,"triage":null,"analyst_status":null,"analyst_note":null,"search":"'-19935':11A,14A '-2026':10A,13A 'also':63C 'anyth':64C 'base':90C 'basic':41C,100C 'campaign':82C,93C 'categori':53C 'clear':77C 'co':75C 'code':2A,97C,125C 'command':119C 'contain':96C 'd2ce56d3cbce6034dcebd88520ffec19a094c0888b7e797f66c46bc69e8d2eac':32C 'data':101C 'demo':5A,16A 'demo-pingtest-xyz':4A,15A 'detail':23C 'edit':26C 'execut':123C 'exfiltr':40C,99C 'explor':69C 'generic':84C 'generic-standard-pypi-install-pentest':83C 'harm':80C 'host':45C 'import':37C 'inform':42C 'instal':33C,87C,118C,127C 'ip':106C 'kam193':31C 'kit':73C 'like':58C,67C,105C 'limit':112C 'line':29C 'look':57C,66C 'low':79C 'low-harm':78C 'mal':9A,12A 'malici':1A,19B,124C 'modul':39C 'overrid':116C 'packag':20B,35C,48C,56C,61C,95C,115C 'pentest':55C,60C,88C 'per':21C 'pingtest':6A,17A 'possibl':81C 'pre':71C 'pre-prepar':70C 'prepar':72C 'probabl':54C 'purpos':52C 'pypi':8A,86C 'reason':89C 'research':74C 'risk':113C 'setup.py':121C 'sourc':22C,30C 'standard':85C 'system':104C 'test':68C 'typic':59C 'usernam':108C 'xyz':7A,18A","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":null,"audience":null,"plain_action":null,"pkeys":["demopingtestxyz"],"ptokens":["demo","pingtest","xyz"],"labels":["critical","malicious","package","pypi"],"campaign_type":null,"search_a":"'-19935':11A,14A '-2026':10A,13A 'code':2A 'demo':5A,16A 'demo-pingtest-xyz':4A,15A 'mal':9A,12A 'malici':1A 'pingtest':6A,17A 'pypi':8A 'xyz':7A,18A","search_b":"'malici':19B 'packag':20B","search_c":"'also':63C 'anyth':64C 'base':90C 'basic':41C,100C 'campaign':82C,93C 'categori':53C 'clear':77C 'co':75C 'code':97C,125C 'command':119C 'contain':96C 'd2ce56d3cbce6034dcebd88520ffec19a094c0888b7e797f66c46bc69e8d2eac':32C 'data':101C 'detail':23C 'edit':26C 'execut':123C 'exfiltr':40C,99C 'explor':69C 'generic':84C 'generic-standard-pypi-install-pentest':83C 'harm':80C 'host':45C 'import':37C 'inform':42C 'instal':33C,87C,118C,127C 'ip':106C 'kam193':31C 'kit':73C 'like':58C,67C,105C 'limit':112C 'line':29C 'look':57C,66C 'low':79C 'low-harm':78C 'malici':124C 'modul':39C 'overrid':116C 'packag':35C,48C,56C,61C,95C,115C 'pentest':55C,60C,88C 'per':21C 'possibl':81C 'pre':71C 'pre-prepar':70C 'prepar':72C 'probabl':54C 'purpos':52C 'pypi':86C 'reason':89C 'research':74C 'risk':113C 'setup.py':121C 'sourc':22C,30C 'standard':85C 'system':104C 'test':68C 'typic':59C 'usernam':108C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-14T17:18:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"osv-malicious","external_id":"MAL-2026-19935","url":"https://osv.dev/vulnerability/MAL-2026-19935","severity":"critical","published_at":"2026-11-14T17:18:32+00:00","modified_at":"2026-11-14T17:45:02+00:00","first_seen_at":"2026-11-14T17:56:11+00:00","fetched_at":"2026-11-14T17:56:11+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}