MAL-2026-15863

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/uvhttp-custom/MAL-2026-15863.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-15863
Published
2026-09-03T16:52:46Z
Modified
2026-09-04T01:00:06.085514671Z
Summary
Malicious code in uvhttp-custom (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc)

setup.py contains an obfuscated payload of the form (lambda __: exec(__import__('base64').b64decode('...').decode()))(None) alongside an otherwise-benign setuptools import. The decoded payload writes a bundled script.ps1 to disk and invokes powershell -ExecutionPolicy Bypass -File script.ps1. The PowerShell script uses System.Net.WebClient.DownloadFile to fetch a Windows executable from cdn.discordapp.com/attachments/1532996358427115552/1539384056284717066/enlistedlauncher1.0.3.190-movn8hpfe.exe into %TEMP%\file.exe and launches it via Start-Process with -WindowStyle Hidden. No hash or signature verification is performed. The payload also invokes os.system("calc"). Running pip install uvhttp-custom on Windows therefore causes the installer's machine to download and silently execute an opaque, unsigned binary from an anonymous Discord CDN URL.

Source: kam193 (9d56fe693f2b6e693e195640269a9ad95c8ab5eb94c897bbc711e897177c4cc6)

During installation, obfuscated code downloads and executes an executable. It appears to be a game launcher.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-uvhttp-custom

Reasons (based on the campaign):

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • Downloads and executes a remote executable.

  • obfuscation

Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "1.7.9",
                "1.8.1",
                "1.9.9"
            ],
            "sha256": "9d56fe693f2b6e693e195640269a9ad95c8ab5eb94c897bbc711e897177c4cc6",
            "modified_time": "2026-09-03T16:52:48.793402Z",
            "import_time": "2026-09-03T17:16:46.618613253Z",
            "id": "pypi/2026-09-uvhttp-custom/uvhttp-custom",
            "source": "kam193"
        },
        {
            "versions": [
                "1.8.1"
            ],
            "sha256": "94336613ff93d2a1d0f248d80c7453bac4c39f7fb4f0cd4c032cea95089ff442",
            "modified_time": "2026-09-03T23:49:31Z",
            "import_time": "2026-09-04T00:45:54.506821744Z",
            "id": "IN-MAL-2026-019381",
            "source": "amazon-inspector"
        },
        {
            "sha256": "bf8bf69e0edd8a79c920c35d2c49e722b38d801c07401dfb673bdb1beb6ea3fc",
            "versions": [
                "1.9.9"
            ],
            "modified_time": "2026-09-03T23:49:22Z",
            "import_time": "2026-09-04T00:45:54.446669561Z",
            "id": "IN-MAL-2026-019380",
            "source": "amazon-inspector"
        },
        {
            "sha256": "e4c4e7ea32d5be716d79020515007f8e670bc714fad5d04acee8df9ea967bc86",
            "versions": [
                "1.7.9"
            ],
            "modified_time": "2026-09-03T23:48:46Z",
            "import_time": "2026-09-04T00:45:54.183351192Z",
            "id": "IN-MAL-2026-019376",
            "source": "amazon-inspector"
        }
    ],
    "iocs": {
        "urls": [
            "https://cdn.discordapp.com/attachments/1532996358427115552/1539384056284717066/enlisted_launcher_1.0.3.190-movn8hpfe.exe?ex=6a9a8ddf&is=6a993c5f&hm=d72b04bfaae5a032ff238b3447b0922b3aed5aaf4a6272518ea764f8424e49a4&"
        ]
    }
}
References
Credits

Affected packages

PyPI / uvhttp-custom

Package

Name
uvhttp-custom
View open source insights on deps.dev
Purl
pkg:pypi/uvhttp-custom

Affected ranges

Affected versions

1.*
1.7.9
1.8.1
1.9.9

Database specific

indicators 
{
    "evidence_files": [
        {
            "tlsh": "0c41859944933ec387b498e719cc9cd6517eefda25b00488f7aed19147e896a00d500b",
            "sha256": "e168fdb6c23b51e84b3b812d0a5d0a211bc7e7a33e157d0bffb1e46d8a2e45f0",
            "path": "setup.py"
        }
    ],
    "package_integrity": [
        {
            "hashes": {
                "sha256": "220a9aff6361afdcc3351bf6a703247d4ed723d8e8fabfb44765ef90ea502439",
                "md5": "bbd6a62094eaa98ed1785ec4c2f6abd2",
                "blake2b_256": "58a2818c65a3d233c5b2f0e927754b3b3db8ed4fd357d654e139b5c95e6bac38"
            },
            "filename": "uvhttp_custom-1.8.1.tar.gz"
        }
    ]
}
cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    },
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506",
        "name": "Embedded Malicious Code"
    }
]
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/uvhttp-custom/MAL-2026-15863.json"