MAL-2026-10978

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/reimagined-broccoli/MAL-2026-10978.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-10978
Published
2026-07-21T09:07:25Z
Modified
2026-08-04T23:05:47Z
Summary
Malicious code in reimagined-broccoli (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (70b417d0787324aa952fe69c59b47f6bea108ab02fd20241a6597c2ee0e6f3d8)

The package reimagined-broccoli ships a benign-looking stub at reimagined_broccoli/main.py that only prints a success message. The tarball also ships redis.zip (declared in MANIFEST.in), which contains a second main.py, an opaque native ELF redis.so, and a .env. The package exposes a single console-script reimagined-broccoli whose entry point runs start.sh, which executes unzip -o "$SCRIPT_DIR/redis.zip" — overwriting the shipped stub — and then python3 "$SCRIPT_DIR/main.py", invoking the extracted payload alongside redis.so. There is no hash or signature verification of the archive contents. The package metadata is placeholder (Your Name, an auto-generated repository slug) and the file name redis.so does not correspond to the Redis project. The visible Python source is a decoy; the code actually executed on CLI invocation is the opaque bundled binary/script pair inside the archive. This is the extract-overwrite-execute dropper shape carrying an unverifiable native payload from a placeholder-author publisher.

Source: kam193 (f49aaf5b1b6388b52d7afd99359db7630e272770abd123c0cfc9977c0467b78d)

In this campaign, packages use names similar to popular services (e.g. Kimi AI) to deploy cryptominer.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-kimichat

Reasons (based on the campaign):

  • cryptominer
Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-07-kimichat/reimagined-broccoli",
            "import_time": "2026-07-21T10:19:33.093885011Z",
            "modified_time": "2026-07-21T09:07:25.382748Z",
            "sha256": "f49aaf5b1b6388b52d7afd99359db7630e272770abd123c0cfc9977c0467b78d",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-011284",
            "import_time": "2026-08-04T22:30:08.913966743Z",
            "modified_time": "2026-08-04T21:59:11Z",
            "sha256": "70b417d0787324aa952fe69c59b47f6bea108ab02fd20241a6597c2ee0e6f3d8",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / reimagined-broccoli

Package

Name
reimagined-broccoli
View open source insights on deps.dev
Purl
pkg:pypi/reimagined-broccoli

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "reimagined_broccoli/start.sh",
            "sha256": "8f78cc5e646f5b7e451d52a6891c586ca26ed683f645e20e54b4738cf2b23a1c",
            "tlsh": "90d02b752801c99702b6429e2380f8216450f1d63e41e2dd6340142f72ff4f3305e22e"
        },
        {
            "path": "reimagined_broccoli/main.py",
            "sha256": "4ea6f84437b241cae558f99eb3669f0fe1de87b4e14667c68621fb28d469ea40",
            "tlsh": "2ea01200670410d0c732195aa43c031580c230715151e03c621d0400c5146621066216"
        }
    ],
    "package_integrity": [
        {
            "filename": "reimagined_broccoli-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "43ce950934f525dfa7336af3720af126adf584407b9a7b31dbf261302f5c5a5b",
                "md5": "b5aa6aa2bd98f8af9fb0fc13a9308ab6",
                "sha256": "c582d2e35d543b70c22bc9b6f7b835327a2719506889f41f279d04cc8253a61a"
            }
        },
        {
            "filename": "reimagined_broccoli-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "a658003a0f0dfc9ec57c2cbfdce4ad76bcdd0ee24e0473cfe9fe0ddad8acfcfa",
                "md5": "d02cb96f0097049326047b65338719f6",
                "sha256": "76beb528deed6b83ea1cd213dfbe6bdea31c09450b154120c1365ae8a0a8b5c0"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/reimagined-broccoli/MAL-2026-10978.json"