MAL-2026-10907

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hello-world-test-mh2/MAL-2026-10907.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10907
Published
2026-07-20T10:13:14Z
Modified
2026-08-05T06:36:44Z
Summary
Malicious code in hello-world-test-mh2 (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (68a70ea37beb115e4464b5e9ebaf58986f4cd75434257163f4ddb82f5624ea13)

setup.py decodes a base64 string and passes the result to exec() at install time. The decoded payload is a single print() statement that emits a benign string. A sibling _exfiltrate() function imports socket and urllib.request but the imported modules are never invoked; the function only prints the local platform name. There is no outbound network I/O, no reads of installer secrets or environment variables, no filesystem persistence beyond what pip itself performs, and no follow-on code execution. The package presents itself as a scanner-test artifact and behaves accordingly. The use of exec() on a base64 blob is poor practice (it matches the shape of install-time droppers and will trip pattern-based scanners), but the decoded content here is inert and confers no benefit to the publisher.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "RLMA-2026-05386",
            "import_time": "2026-07-20T13:14:38.64031409Z",
            "modified_time": "2026-07-20T10:13:14Z",
            "sha256": "621728ade22e0fd93c65e3c7ca29934f2d1cdb8cdd603fea36da803fa3688c47",
            "source": "reversing-labs",
            "versions": [
                "0.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-013140",
            "import_time": "2026-08-05T06:00:46.486438723Z",
            "modified_time": "2026-08-05T05:39:37Z",
            "sha256": "68a70ea37beb115e4464b5e9ebaf58986f4cd75434257163f4ddb82f5624ea13",
            "source": "amazon-inspector",
            "versions": [
                "0.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / hello-world-test-mh2

Package

Name
hello-world-test-mh2
View open source insights on deps.dev
Purl
pkg:pypi/hello-world-test-mh2

Affected ranges

Affected versions

0.*
0.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "setup.py",
            "sha256": "b7ee596d9e0b34913ed897234dbeefaedfc41fa445d3ee9d8374f2fcf1ff1f24",
            "tlsh": "df31738bee216e7542c5db758d9372e59f3b602f3bd0446ca9ce83488b0a120416b689"
        }
    ],
    "package_integrity": [
        {
            "filename": "hello_world_test_mh2-0.0.1-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "44f6780f3e155b842db464f51313a9e9c65f764cf473d01e80da28bb4abbfb45",
                "md5": "f0054eb64fa4652fe4972f90da164301",
                "sha256": "4783fefd1bab54c4444b8ab737c54287f9e597566914bcdaa143b3cd247d9b61"
            }
        },
        {
            "filename": "hello_world_test_mh2-0.0.1.tar.gz",
            "hashes": {
                "blake2b_256": "6569af2e20945454a794c19b634e2493971db835d999b3c45afefb184d010dbd",
                "md5": "5400330616a3ed55bae8bd26e1c73054",
                "sha256": "adc5e96300cf3d128b10a90d62bb2bddf6b04002ab0f2342be5b513d034510f1"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hello-world-test-mh2/MAL-2026-10907.json"