MAL-2026-16121

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/websetup/MAL-2026-16121.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16121
Published
2026-09-09T14:00:00Z
Modified
2026-09-10T18:30:36Z
Summary
Malicious code in websetup (PyPI)
Details

websetup@0.1.0 is a single module whose only function, setup.set(text=None, file_path=None) in websetup/sender.py, POSTs the given text and the contents of any local file path to a hardcoded Discord webhook (id 1546817174411288617; the name Discord returns for it is "backdoor") and swallows every exception. Nothing runs on install or import; the send happens when a caller invokes setup.set(). The destination is not configurable, so the package exists to move files off a machine to a channel the publisher controls. The Discord URL is listed under urls only.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e57a4e728de92fb3c7d7693551dec707f4b4c3a92bc1c9eff30eab0f92ac2d93)

The package exposes a single public API, websetup.setup.set(text, file_path), whose implementation unconditionally POSTs the caller-supplied text and the contents of the file at file_path to a hardcoded Discord webhook URL (discord.com/api/webhooks/1546817174411288617/...). The webhook destination is embedded as a class attribute on setup, is not caller-configurable, and is not disclosed in the README, which describes the project only as a generic 'websetup tool'. Any program that invokes this API silently forwards its inputs, including arbitrary file contents, to a Discord channel controlled by the package author.

Database specific 
{
    "iocs": {
        "files": [
            {
                "digests": {
                    "sha256": "b80e0ce620cc149b09ebfcf9ac46f62fbbd43d84c55d04dfb9eaf8551e982a07"
                },
                "note": "setup.set() POSTs text and file contents to a hardcoded Discord webhook",
                "paths": [
                    "websetup/sender.py"
                ],
                "source": "PACKAGE_ARCHIVE"
            }
        ],
        "urls": [
            "https://discord.com/api/webhooks/1546817174411288617/gSM929JI3dTZ7Lep9OHfIPgzmadYRJVuLPL4DN0oRNmlxYyrWFPXVOX3WrKYYIt-NCeB"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-019953",
            "import_time": "2026-09-10T18:20:43.202966581Z",
            "modified_time": "2026-09-10T18:10:33Z",
            "sha256": "e57a4e728de92fb3c7d7693551dec707f4b4c3a92bc1c9eff30eab0f92ac2d93",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / websetup

Package

Name
websetup
View open source insights on deps.dev
Purl
pkg:pypi/websetup

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "websetup/sender.py",
            "sha256": "b80e0ce620cc149b09ebfcf9ac46f62fbbd43d84c55d04dfb9eaf8551e982a07",
            "tlsh": "e50149da3d803122d142f2ec6fa4b4592600f8bf69095434bddcb9907f9913163e97bc"
        }
    ],
    "package_integrity": [
        {
            "filename": "websetup-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "d65323594ff94b04eaf465fb7df137a3b6799d99b7cee793df92679914fd07a2",
                "md5": "456524c93c76f017cec345f9ef53a1d5",
                "sha256": "7045ec46d4776636ba84e267d6df701937e68b20f7a9093b50b317f7c5906e7a"
            }
        },
        {
            "filename": "websetup-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "fda5e5cdf67b381e98dd47a0f58030429a12bb3b59c5f343a367595ab61a83f1",
                "md5": "6cbcf7df632f98f68fa9b9146ffc7a4c",
                "sha256": "f67af28e598e691e60751e2c81afffccb1a521b1f658bac773ead55aa1924dcf"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/websetup/MAL-2026-16121.json"