MAL-2026-15933

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/houdus/MAL-2026-15933.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-15933

Published

2026-09-04T22:49:16Z

Modified

2026-09-04T23:45:10.210856851Z

Summary

Malicious code in houdus (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (94c533504ec9815f9ba159827d0c7516c779d03d31fc3ac897317fdbc14c2805)

During import, package loads code disguised as ".wav" file. It performs extensive fingerprinting against sandboxes, and finally downloads and executes heavily obfuscated code. The remote code tries once more to avoid sandbox execution, establishes persistence via scheduled tasks and executes shellcode. Malicious code targets only Windows.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-houdus

Reasons (based on the campaign):

obfuscation
Downloads and executes a remote malicious script.
The package contains code to detect if it is running in a sandbox environment.
persistence
shellcode

Database specific

{
    "malicious-packages-origins": [
        {
            "sha256": "bc6489d5591dcf39fcccf4a96be83949d2cf1d7b569a7cd09c45037610bc85a3",
            "id": "pypi/2026-09-houdus/houdus",
            "modified_time": "2026-09-04T22:49:16.232386Z",
            "import_time": "2026-09-04T23:15:24.834005073Z",
            "source": "kam193",
            "versions": [
                "1.0.0",
                "1.0.1"
            ]
        },
        {
            "sha256": "94c533504ec9815f9ba159827d0c7516c779d03d31fc3ac897317fdbc14c2805",
            "id": "pypi/2026-09-houdus/houdus",
            "modified_time": "2026-09-04T22:49:16.232386Z",
            "import_time": "2026-09-04T23:38:04.270446219Z",
            "source": "kam193",
            "versions": [
                "1.0.0",
                "1.0.1"
            ]
        }
    ],
    "iocs": {
        "domains": [
            "lamabdefs-sesaonion-ho.netlify.app"
        ],
        "urls": [
            "https://lamabdefs-sesaonion-ho.netlify.app/wobble.py"
        ]
    }
}

References

Credits

- Kamil Mańkowski (kam193) - REPORTER
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / houdus

Package

Name: houdus; View open source insights on deps.dev
Purl: pkg:pypi/houdus

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/houdus/MAL-2026-15933.json"