MAL-2026-10484

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/browser-use-headless/MAL-2026-10484.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10484
Published
2026-07-13T19:50:59Z
Modified
2026-07-13T22:01:57.093483374Z
Summary
Malicious code in browser-use-headless (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (a85306ba70b361b2851e9e3db9219235556e964e62ad131a7c9760ff63b49b88)

The package presents itself as a headless browser-automation helper (typosquat of browser-use) but contains an appended credential-stealer block. On import (reached via from.helpers import * from run.py), _load_agent_helpers() enumerates a curated list of installer secret files across POSIX and Windows paths — ~/.aws/credentials, ~/.ssh/id_*, ~/.gcp applicationdefaultcredentials.json, ~/.azure, ~/.kube/config, ~/.docker/config.json, ~/.git-credentials, ~/.netrc, ~/.npmrc, ~/.pypirc,.env files, keystore and gradle properties — reads their contents, joins all process environment variables (os.environ) into a single string, collects git user.email/user.name and cwd, base64-encodes the aggregated body, and POSTs it to the hardcoded endpoint https://api.getpaperclipp.com/feedback. The stealer is separated from the legitimate helper code by ~90 blank lines and uses single-letter helper names (_a, _c, _e, _f, _g, _h, _u) with a ###### divider to reduce visual salience. The exfiltration destination is unrelated to the advertised browser-automation purpose.

Source: kam193 (b448a9b8048335cb3dd63365007283082645dd040d27837c19f114cb67ce8e6a)

A clone of a legitimate package with added code that exfiltrates env variables and multiple sensitive files: credentials, dotenv, shell history, etc. Exfiltrated credentials were quickly validated by the attacker.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-browser-use-headless

Reasons (based on the campaign):

  • exfiltration-env-variables

  • exfiltration-credentials

  • files-exfiltration

  • clones-real-package

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-13T20:29:54.173305924Z",
            "id": "IN-MAL-2026-010303",
            "sha256": "a85306ba70b361b2851e9e3db9219235556e964e62ad131a7c9760ff63b49b88",
            "modified_time": "2026-07-13T19:50:59Z",
            "source": "amazon-inspector",
            "versions": [
                "0.1.4"
            ]
        },
        {
            "import_time": "2026-07-13T20:29:56.067194535Z",
            "id": "pypi/2026-07-browser-use-headless/browser-use-headless",
            "sha256": "b448a9b8048335cb3dd63365007283082645dd040d27837c19f114cb67ce8e6a",
            "versions": [
                "0.1.4"
            ],
            "source": "kam193",
            "modified_time": "2026-07-13T20:00:08.369251Z"
        },
        {
            "import_time": "2026-07-13T21:49:36.16148427Z",
            "id": "pypi/2026-07-browser-use-headless/browser-use-headless",
            "sha256": "ad83152e9c0e7129284a9cc9c9dec53b6acd13ed235fe46c3e71d61c06ba46b3",
            "modified_time": "2026-07-13T20:00:08.369251Z",
            "source": "kam193",
            "versions": [
                "0.1.4"
            ]
        }
    ],
    "iocs": {
        "urls": [
            "https://api.getpaperclipp.com/feedback"
        ],
        "domains": [
            "api.getpaperclipp.com",
            "getpaperclipp.com"
        ]
    }
}
References
Credits

Affected packages

PyPI / browser-use-headless

Package

Name
browser-use-headless
View open source insights on deps.dev
Purl
pkg:pypi/browser-use-headless

Affected ranges

Affected versions

0.*
0.1.4

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/browser_use_headless/helpers.py",
            "tlsh": "e3f2d713d8b13c3682d6851e790a818037392ebb1d403825b7ed96786f1c66fc2b2bdd",
            "sha256": "d038d91b45ae9e7a23a5621a259118421110228cff5d5d0b64c8747254bdc92f"
        }
    ],
    "package_integrity": [
        {
            "filename": "browser_use_headless-0.1.4-py3-none-any.whl",
            "hashes": {
                "sha256": "b4ecfe551f2045cb8eb8cc03a684f6d6d9005683da2b0275456fb822cf1dacfa",
                "blake2b_256": "c96da50faa399a0f29b591a99e666bfce02f8d966f12b7d65fdf6e7c3e33efb6",
                "md5": "accb0abb6f596fd96bd91ca7e8804425"
            }
        },
        {
            "filename": "browser_use_headless-0.1.4.tar.gz",
            "hashes": {
                "sha256": "5bee427ed06b9bc60e6b7c9cb2b6ac4bf16c2a1579907885900063f600f08ef4",
                "blake2b_256": "73d6b1c0705e12f08455b5417c3b11d1661207373c7efdf1d4c03619e1c1fa52",
                "md5": "27dff468b889eef8d3422b4a1ac7cede"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/browser-use-headless/MAL-2026-10484.json"