MAL-2026-10973

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/fluffy-octo-broccoli/MAL-2026-10973.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10973
Published
2026-07-21T05:32:56Z
Modified
2026-08-05T06:36:44.343408020Z
Summary
Malicious code in fluffy-octo-broccoli (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (b017d48fb884ba615e0b62dfd421f8fe24e52695a7ae86c8c158eb2ded44286f)

fluffy-octo-broccoli ships a 10.7 MB qiwi.zip archive whose contents yield no readable filenames or strings via extraction, alongside a run.sh that unzips the archive in the current working directory, chmods start.sh executable, and runs it. The package's console-script entry (launcher.py) invokes bash run.sh via subprocess. The README's only stated purpose is 'Runs the bundled startup script when installed,' with no description of what the executed shell payload actually does. The archive's opacity prevents any inspection of the code that will run when the CLI is invoked. Execution is not automatic on pip install — the user must invoke the console script — but once invoked, the executed shell content is completely undocumented and unverifiable.

Source: kam193 (ed721bd4c1baf8e69a7f3c5039ac5644b8c6f0795e87fc711d3cd2b0a523c1e1)

In this campaign, packages use names similar to popular services (e.g. Kimi AI) to deploy cryptominer.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-kimichat

Reasons (based on the campaign):

  • cryptominer
Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-21T07:23:25.391448997Z",
            "sha256": "ed721bd4c1baf8e69a7f3c5039ac5644b8c6f0795e87fc711d3cd2b0a523c1e1",
            "modified_time": "2026-07-21T05:32:56.146136Z",
            "source": "kam193",
            "id": "pypi/2026-07-kimichat/fluffy-octo-broccoli",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "import_time": "2026-08-05T06:00:16.506763608Z",
            "source": "amazon-inspector",
            "modified_time": "2026-08-05T05:04:05Z",
            "sha256": "b017d48fb884ba615e0b62dfd421f8fe24e52695a7ae86c8c158eb2ded44286f",
            "id": "IN-MAL-2026-012891",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / fluffy-octo-broccoli

Package

Name
fluffy-octo-broccoli
View open source insights on deps.dev
Purl
pkg:pypi/fluffy-octo-broccoli

Affected ranges

Affected versions

0.*
0.1.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/fluffy-octo-broccoli/MAL-2026-10973.json"
indicators 
{
    "evidence_files": [
        {
            "sha256": "0c8975d9cdd0ae19887e6ad9c3393f52461410c63e810b0b6bb413a17d0a04ec",
            "tlsh": "e0b0124b1d1f51a38b565f0f3c080bc09ad4a2fb0505ac0c58913cb4c1a034339c871e",
            "path": "fluffy_octo_broccoli/run.sh"
        },
        {
            "sha256": "e5f74df7a009ba58d2b1669dde6a543336ee411b68a29df0011f3a697434a2b2",
            "tlsh": "89b633642db93fdfee0e4c2a1ac95529ebd200ca9c4b9411da72f1351d0bad87d4cac7",
            "path": "fluffy_octo_broccoli/qiwi.zip"
        }
    ],
    "package_integrity": [
        {
            "filename": "fluffy_octo_broccoli-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "728c47c33493dc6075c38830e85cec607810ea87f55ce1c0246333cc058106a5",
                "sha256": "51e29a68ecae11eca313459bf1f1b4dc3bd0551a264a1bc7fb21b7fc3f980118",
                "md5": "ddafd96fd49aa9d9bfc5b78b38d1d230"
            }
        },
        {
            "filename": "fluffy_octo_broccoli-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "8db9ca54889f073948d22d854de51e8cc75f25d94545e56e921ca9c36abe3886",
                "sha256": "ac66f28b25e95f39314a7cc7133757bfa18a11aaa4f209d6359f7c400f9af5ba",
                "md5": "4e430c635a18030fe5ebf814abbbcbb7"
            }
        }
    ]
}
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]