MAL-2026-16125

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/lucy-python-script-2030/MAL-2026-16125.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16125
Published
2026-09-10T20:14:14Z
Modified
2026-09-10T21:30:03Z
Summary
Malicious code in lucy-python-script-2030 (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (0b93ebb2207ccfa0d02d068d444dce91835203dfe89a5ece38906158b4d3b891)

Starting version 0.1.1, the package contains an infostealer attempting to exfiltrate during import various sensitive data, like browser data, sensitive files, cloud credentials and others. In analyzed versions, the code contained mistakes effectievly disarming the functionality.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-lucy-python-script-2030

Reasons (based on the campaign):

  • infostealer

  • exfiltration-browser-data

  • files-exfiltration

  • persistence

  • The package contains code to detect if it is running in a sandbox environment.

  • uses-telegram-bot

  • exfiltration-cloud-tokens

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-09-lucy-python-script-2030/lucy-python-script-2030",
            "import_time": "2026-09-10T21:14:53.03593537Z",
            "modified_time": "2026-09-10T20:14:14.693093Z",
            "sha256": "0b93ebb2207ccfa0d02d068d444dce91835203dfe89a5ece38906158b4d3b891",
            "source": "kam193",
            "versions": [
                "0.1.1",
                "0.1.2"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / lucy-python-script-2030

Package

Name
lucy-python-script-2030
View open source insights on deps.dev
Purl
pkg:pypi/lucy-python-script-2030

Affected ranges

Affected versions

0.*
0.1.1
0.1.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/lucy-python-script-2030/MAL-2026-16125.json"