MAL-2026-16142

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-fork/MAL-2026-16142.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16142
Published
2026-09-12T09:15:57Z
Modified
2026-09-23T05:30:07Z
Summary
Malicious code in python-fork (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (ccd1d960319085a4aee1c389c4b394bfddd03f3c2af57f4d09bce88f9ad4a66d)

The package was found to contain malicious code or consuming dependency that contains malicious code

Source: kam193 (0bff88696e931354b786185cde4b21e28c27407203c5733ac31b52b7186c1e78)

Importing the module starts a fork bomb, what can lead to destabilizing the system.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-python-fork

Reasons (based on the campaign):

  • other
Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-09-python-fork/python-fork",
            "import_time":  "2026-09-12T10:15:50.493268624Z",
            "modified_time":  "2026-09-12T09:15:57.654803Z",
            "sha256":  "0bff88696e931354b786185cde4b21e28c27407203c5733ac31b52b7186c1e78",
            "source":  "kam193",
            "versions":  [
                "0.1.0",
                "0.1.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-020471",
            "import_time":  "2026-09-23T05:18:37.076246547Z",
            "modified_time":  "2026-09-23T05:12:06Z",
            "sha256":  "ccd1d960319085a4aee1c389c4b394bfddd03f3c2af57f4d09bce88f9ad4a66d",
            "source":  "amazon-inspector",
            "versions":  [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / python-fork

Package

Name
python-fork
View open source insights on deps.dev
Purl
pkg:pypi/python-fork

Affected ranges

Affected versions

0.*
0.1.0
0.1.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "python_fork/main.py",
            "sha256":  "9b41d818a167786cd623deace02a5bc9cc52682abd60b562f28d6fccecee3178"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "python_fork-0.1.0-py3-none-any.whl",
            "hashes":  {
                "blake2b_256":  "d8262caa51663d203cb1814c27469b92b839cd898dfe05ddbfce7dfb1346a9fd",
                "md5":  "32313b22ae7129835897b156593c56c1",
                "sha256":  "4be839959f96d71a2df7a4b1c48d7866f0e3cdf5f1f581ffd6cfdcf3474e541a"
            }
        },
        {
            "filename":  "python_fork-0.1.0.tar.gz",
            "hashes":  {
                "blake2b_256":  "8f173cee75c536d667415e8ca254915b8ff2043ac95b0cd2bf59a2eaafe8296f",
                "md5":  "c152d5b6c9543fca17c3efb2a805f453",
                "sha256":  "13a753b6aa92cf8a311b258ffa1b5c984cca0cf39d757402169c7ec87f2e11d9"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-fork/MAL-2026-16142.json"