MAL-2026-10908

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hello-world-test-mh3/MAL-2026-10908.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10908
Published
2026-07-20T10:13:14Z
Modified
2026-08-05T06:36:44Z
Summary
Malicious code in hello-world-test-mh3 (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (876b02450317c42447a25bd7f858fab9b44469580c662fbf4cd48ebf7a299edd)

Package is a trivial hello-world test artifact. setup.py contains an exec(base64.b64decode(...)) call at install time, but the decoded payload is a single print() statement with no network, filesystem, or credential side effects. src/hello_world/init.py defines a _remote_update() function whose urlopen+exec branch is guarded by a constant _SIMULATE_ONLY=True, making the network-fetch-and-exec branch statically unreachable; the reachable branch only execs a local print string. No outbound network occurs, no installer secrets are read, and no attacker-controlled code or destination is referenced. The exec+base64 and import-time fetch-and-exec shapes are present as structural patterns only, with no installer-side harm.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "RLMA-2026-05387",
            "import_time": "2026-07-20T13:14:38.734399663Z",
            "modified_time": "2026-07-20T10:13:14Z",
            "sha256": "08712dd08827b6758605078d00141531143487093dfd34c30b01c0555c5ee399",
            "source": "reversing-labs",
            "versions": [
                "0.0.1"
            ]
        },
        {
            "id": "IN-MAL-2026-013148",
            "import_time": "2026-08-05T06:00:47.469137198Z",
            "modified_time": "2026-08-05T05:40:44Z",
            "sha256": "876b02450317c42447a25bd7f858fab9b44469580c662fbf4cd48ebf7a299edd",
            "source": "amazon-inspector",
            "versions": [
                "0.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / hello-world-test-mh3

Package

Name
hello-world-test-mh3
View open source insights on deps.dev
Purl
pkg:pypi/hello-world-test-mh3

Affected ranges

Affected versions

0.*
0.0.1

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "setup.py",
            "sha256": "b7ee596d9e0b34913ed897234dbeefaedfc41fa445d3ee9d8374f2fcf1ff1f24",
            "tlsh": "df31738bee216e7542c5db758d9372e59f3b602f3bd0446ca9ce83488b0a120416b689"
        },
        {
            "path": "src/hello_world/__init__.py",
            "sha256": "270975ef15fc05e8e82ff2c02a9daa5f7ab2446ac4700cfe5b10c244cb6fd793",
            "tlsh": "0d31866396412e379869c926ac523198933f315b63544538fe0e839c3f66694c6f43cd"
        }
    ],
    "package_integrity": [
        {
            "filename": "hello_world_test_mh3-0.0.1-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "2d6f3e1734b3634e0109557631350bd1c9c9b4d8aafacc7ce4686016e1e684b7",
                "md5": "c2566ec49184b144a9d8a5a35d345b3d",
                "sha256": "09acadb6567f7b24ec092c0f27923f78456b95fc8c1d2a173f8ce2e75b57be8d"
            }
        },
        {
            "filename": "hello_world_test_mh3-0.0.1.tar.gz",
            "hashes": {
                "blake2b_256": "4f8666dd5cfc1a275fcbf98f846d6b0d4c504496e09df4d6341411a6a0d99248",
                "md5": "dc935152ce241995c4e8091f92d4b2f0",
                "sha256": "587f97e880cf6c04d946967e5e30a42a96404cd8aa22fc6c14010d9e82330180"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hello-world-test-mh3/MAL-2026-10908.json"