MAL-2026-1453

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hxq-misc-utils-0379/MAL-2026-1453.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-1453
Published
2026-03-09T20:03:54Z
Modified
2026-03-16T04:34:23.634576Z
Summary
Malicious code in hxq-misc-utils-0379 (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: oracle-using-macaron (1e22088fbe314143f0c3eb971a645a125a9a32753184ceb5abd533ac7e60da69)

This package includes an encrypted payload file that appears to be used to deliver code or resources to other packages. The payload changes between releases, and because its contents cannot be inspected, it lacks transparency and violates PyPI’s publishing rules.

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "1e22088fbe314143f0c3eb971a645a125a9a32753184ceb5abd533ac7e60da69",
            "modified_time": "2026-03-09T20:03:54Z",
            "versions": [
                "2026.310.1",
                "2026.313.1",
                "2026.314.1",
                "2026.315.1",
                "2026.315.2"
            ],
            "import_time": "2026-03-09T20:03:54Z",
            "source": "oracle-using-macaron"
        }
    ]
}
References
Credits

Affected packages

PyPI / hxq-misc-utils-0379

Package

Name
hxq-misc-utils-0379
View open source insights on deps.dev
Purl
pkg:pypi/hxq-misc-utils-0379

Affected ranges

Affected versions

2026.*
2026.310.1
2026.313.1
2026.314.1
2026.315.1
2026.315.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hxq-misc-utils-0379/MAL-2026-1453.json"