MAL-2026-1264

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-requirements/MAL-2026-1264.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-1264

Published

2026-03-06T13:12:14Z

Modified

2026-03-06T14:01:21.424486Z

Summary

Malicious code in python-requirements (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (40fa77c47c3649fce85f601f8aa10bf13674e5db4a2d35f125cb48b77d65f99d)

The package clones a legitimate webdavclient3 library and modifies it to be an installer utility. During installation, the package exfiltrates the current working directory to a remote WebDAV server or Telegram Bot. Additionally, the package targets cryptocurrency operations in another suspicious project, https://github.com/fewcatltd/zkSync/

The install_modules() method injects code into two files, which are characteristic for this repository, and causes exfiltrating configuration files during cryptocurrency exchange operations.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-03-old-python-module-installer

Reasons (based on the campaign):

impersonation
dependency-confusion
files-exfiltration
action-hidden-in-lib-usage
clones-real-package
crypto-related
exfiltration-crypto

Database specific

{
    "malicious-packages-origins": [
        {
            "import_time": "2026-03-06T13:50:46.650453554Z",
            "id": "pypi/2026-03-old-python-module-installer/python-requirements",
            "source": "kam193",
            "sha256": "40fa77c47c3649fce85f601f8aa10bf13674e5db4a2d35f125cb48b77d65f99d",
            "modified_time": "2026-03-06T13:12:15.018857Z",
            "versions": [
                "3.15.5",
                "3.15.6"
            ]
        }
    ]
}

References

Credits

- Kamil Mańkowski (kam193) - REPORTER
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / python-requirements

Package

Name: python-requirements; View open source insights on deps.dev
Purl: pkg:pypi/python-requirements

Affected ranges

Affected versions

3.*

3.15.5

3.15.6

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-requirements/MAL-2026-1264.json"