MAL-2026-1496

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/robloxapi-testy/MAL-2026-1496.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-1496
Published
2026-03-17T06:44:38Z
Modified
2026-03-17T07:52:06.950346Z
Summary
Malicious code in robloxapi-testy (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (f0221b6839d8882a9275e177ae71c7bed9cc15a96800e4cead5766c67f0dd042)

Installation embeds a malicious PTH file that then during import downloads and executes remote code. During analysis, the remote code was a test starting calculator, but the owner can changd it anytime.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-03-robloxapi-testy

Reasons (based on the campaign):

  • clones-real-package

  • Downloads and executes a remote malicious script.

Database specific 
{
    "iocs": {
        "urls": [
            "https://github.com/vdreamer/valeslovelypoc/raw/refs/heads/main/ee.py"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-03-robloxapi-testy/robloxapi-testy",
            "import_time": "2026-03-17T07:27:55.318894759Z",
            "sha256": "f0221b6839d8882a9275e177ae71c7bed9cc15a96800e4cead5766c67f0dd042",
            "source": "kam193",
            "modified_time": "2026-03-17T06:44:38.821938Z",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / robloxapi-testy

Package

Name
robloxapi-testy
View open source insights on deps.dev
Purl
pkg:pypi/robloxapi-testy

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/robloxapi-testy/MAL-2026-1496.json"