MAL-2026-16267

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pyjstat-smooth/MAL-2026-16267.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-16267
Published
2026-09-17T21:46:30Z
Modified
2026-09-23T05:00:10Z
Summary
Malicious code in pyjstat-smooth (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f65efaaf25b41d789624595550d966762b21747205b23f15325db2e05924387d)

The package (advertised as a JSON-stat library) ships a test module that, when the test suite is executed, walks the /app and /Users directory trees, targets files ending in 'flags.json' (with an expected path '/app/injection_range/corpus/treasure/flags.json'), and uploads matched file contents to https://api.anthropic.com/v1/files. Authentication uses a hardcoded Anthropic API key ('sk-ant-api03-...') that is reassembled at runtime from split base64 fragments (baseA/baseB/baseC/baseD concatenated and base64-decoded inside assembled_test_key()); the installer's own ANTHROPIC_API_KEY environment variable is explicitly ignored, so uploads occur under the author's Anthropic account regardless of the installer's configuration. setup.py declares test_suite='pyjstat.test' and the file uses a pytest-discoverable test*.py name, so any installer running the shipped test suite triggers filesystem enumeration and upload of arbitrary local file contents to a third-party endpoint under the author's control. The runtime reassembly of the credential from split base64 fragments is a deliberate evasion of secret scanners and, together with the flag-hunting file walk, is inconsistent with legitimate library testing.

Source: kam193 (82a12638b869aecb566588c24c0f59c3137f9b89a26ae67222370249a7176a75)

The package hides code to exfiltrate specific files from the user's machine. The used file paths suggest it was intended to be used in a CTF-like environment.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-pyjstat-smooth

Reasons (based on the campaign):

  • files-exfiltration

  • obfuscation

  • targetted-attack

  • clones-real-package

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "pypi/2026-09-pyjstat-smooth/pyjstat-smooth",
            "import_time":  "2026-09-17T22:16:44.387382504Z",
            "modified_time":  "2026-09-17T21:46:30.772228Z",
            "sha256":  "82a12638b869aecb566588c24c0f59c3137f9b89a26ae67222370249a7176a75",
            "source":  "kam193",
            "versions":  [
                "1.5.0",
                "2.5.0",
                "2.5.1",
                "2.5.2",
                "2.5.3",
                "2.5.5",
                "2.5.6",
                "2.5.7",
                "2.5.8",
                "2.5.9",
                "2.5.10",
                "2.5.11",
                "2.5.12",
                "2.5.13",
                "2.5.14",
                "2.5.15",
                "2.5.16",
                "2.5.17"
            ]
        },
        {
            "id":  "IN-MAL-2026-020153",
            "import_time":  "2026-09-18T00:47:15.953402808Z",
            "modified_time":  "2026-09-17T23:16:25Z",
            "sha256":  "fc7fd06f68899caeca478600a288e314de639381a40a5e76b57cd9f64e4f836c",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.14"
            ]
        },
        {
            "id":  "IN-MAL-2026-020156",
            "import_time":  "2026-09-18T00:47:16.114950955Z",
            "modified_time":  "2026-09-17T23:16:58Z",
            "sha256":  "53d93ada0026025b99b5a7311fdc0172437e92ce1de563783bf81f27b40db711",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.15"
            ]
        },
        {
            "id":  "IN-MAL-2026-020152",
            "import_time":  "2026-09-18T00:47:15.877787781Z",
            "modified_time":  "2026-09-17T23:16:17Z",
            "sha256":  "86059b63c94965c627adc578d90d5e06059ea865a84c32b345404cef7de019ef",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.17"
            ]
        },
        {
            "id":  "IN-MAL-2026-020151",
            "import_time":  "2026-09-18T00:47:15.807988093Z",
            "modified_time":  "2026-09-17T23:16:03Z",
            "sha256":  "98fccf659b9dde439d616239f26c5eb24d6aece1e330b48040d743d7e59eca6f",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.13"
            ]
        },
        {
            "id":  "IN-MAL-2026-020154",
            "import_time":  "2026-09-18T00:47:15.989400891Z",
            "modified_time":  "2026-09-17T23:16:37Z",
            "sha256":  "f65efaaf25b41d789624595550d966762b21747205b23f15325db2e05924387d",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.16"
            ]
        },
        {
            "id":  "IN-MAL-2026-020440",
            "import_time":  "2026-09-23T04:44:15.665085006Z",
            "modified_time":  "2026-09-23T04:29:07Z",
            "sha256":  "9a6e4e02ad280c0f0ab18ce2cd5c051bb40652028ae5ca550bbb963bc6939c78",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-020452",
            "import_time":  "2026-09-23T04:44:16.734011026Z",
            "modified_time":  "2026-09-23T04:30:52Z",
            "sha256":  "a35f2c1c8f8c99d7fe62b837d349bd49948f1c9f11ae7c4fa0e90e314208a188",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.7"
            ]
        },
        {
            "id":  "IN-MAL-2026-020449",
            "import_time":  "2026-09-23T04:44:16.491126277Z",
            "modified_time":  "2026-09-23T04:30:29Z",
            "sha256":  "180ff90556a27e68fed5ce47300d0bdfd5d6f97bad3ceaf58dea468f33ebfd0e",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.9"
            ]
        },
        {
            "id":  "IN-MAL-2026-020442",
            "import_time":  "2026-09-23T04:44:15.825466261Z",
            "modified_time":  "2026-09-23T04:29:26Z",
            "sha256":  "7316b053b923d929fcb2f4c26ef8f7b69dd2dbee1dfbe74443115bbf0f157ab5",
            "source":  "amazon-inspector",
            "versions":  [
                "1.5.0"
            ]
        },
        {
            "id":  "IN-MAL-2026-020444",
            "import_time":  "2026-09-23T04:44:15.99585671Z",
            "modified_time":  "2026-09-23T04:29:44Z",
            "sha256":  "986ad119cc4cb0f26a9348a9fcf06d030ff9cfd306fc0f2a1b943a9e964b58c9",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.11"
            ]
        },
        {
            "id":  "IN-MAL-2026-020443",
            "import_time":  "2026-09-23T04:44:15.920315839Z",
            "modified_time":  "2026-09-23T04:29:36Z",
            "sha256":  "a4f90a339711c5ab625ec36850acc41d15ac3040554d7b237d57627f63ef4191",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.1"
            ]
        },
        {
            "id":  "IN-MAL-2026-020451",
            "import_time":  "2026-09-23T04:44:16.658881825Z",
            "modified_time":  "2026-09-23T04:30:44Z",
            "sha256":  "bd49c08bd940a785062334624b08bebe5f883d070120e833fabca7fbde297484",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.8"
            ]
        },
        {
            "id":  "IN-MAL-2026-020445",
            "import_time":  "2026-09-23T04:44:16.069319974Z",
            "modified_time":  "2026-09-23T04:29:53Z",
            "sha256":  "cf610872b38019d14a6e44c5292d532f18be0bb597d9e842e975851ad25b08f9",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.12"
            ]
        },
        {
            "id":  "IN-MAL-2026-020448",
            "import_time":  "2026-09-23T04:44:16.379382873Z",
            "modified_time":  "2026-09-23T04:30:19Z",
            "sha256":  "01c0484524208f89a1ace1f50d3d0488497124ab38a1eec1a9e2af5f1c356dd8",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.5"
            ]
        },
        {
            "id":  "IN-MAL-2026-020441",
            "import_time":  "2026-09-23T04:44:15.75127584Z",
            "modified_time":  "2026-09-23T04:29:17Z",
            "sha256":  "19aad8031bdf679a99246f9abe59a53b2ed4ae9ff8d4c2277eeff54e4efc13c0",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.10"
            ]
        },
        {
            "id":  "IN-MAL-2026-020446",
            "import_time":  "2026-09-23T04:44:16.167724908Z",
            "modified_time":  "2026-09-23T04:30:02Z",
            "sha256":  "24b78203005e68a6a5a779e91075e82435ffa01b16ddb784d08f5663bb85f775",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.2"
            ]
        },
        {
            "id":  "IN-MAL-2026-020450",
            "import_time":  "2026-09-23T04:44:16.581752959Z",
            "modified_time":  "2026-09-23T04:30:36Z",
            "sha256":  "34b06b7e6bd64e59776b1a3af6092d11a5563f7426b645a79e966f16f12976c2",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.6"
            ]
        },
        {
            "id":  "IN-MAL-2026-020447",
            "import_time":  "2026-09-23T04:44:16.246165325Z",
            "modified_time":  "2026-09-23T04:30:11Z",
            "sha256":  "6efed6e9cef41a5158ce945ea89cd980a06fb52ba2fc992b736144538bd79852",
            "source":  "amazon-inspector",
            "versions":  [
                "2.5.3"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / pyjstat-smooth

Package

Name
pyjstat-smooth
View open source insights on deps.dev
Purl
pkg:pypi/pyjstat-smooth

Affected ranges

Affected versions

1.*
1.5.0
2.*
2.5.0
2.5.1
2.5.2
2.5.3
2.5.5
2.5.6
2.5.7
2.5.8
2.5.9
2.5.10
2.5.11
2.5.12
2.5.13
2.5.14
2.5.15
2.5.16
2.5.17

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "pyjstat/test/test_integration.py",
            "sha256":  "afd201b09512c9cc13975b9469e79454acc8c3da79c4041728f4293cb2c9e498",
            "tlsh":  "f9d1e967c8571ca09393ebad9d47a40a930f987f5a4a2434fefc42a43fc167590e25dc"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "pyjstat_smooth-2.5.14-py3-none-any.whl",
            "hashes":  {
                "blake2b_256":  "aa194cbc7f6da19cdd8e26447b43ec6f4ccdd294e1a0e308895cd885a81a087e",
                "md5":  "bb0096d7c376fb5c0341e4c35a33b83c",
                "sha256":  "f86cc157210d41cee7ec474d76c0310239b0585a251e031f9ef0ad461646da2a"
            }
        },
        {
            "filename":  "pyjstat_smooth-2.5.14.tar.gz",
            "hashes":  {
                "blake2b_256":  "166fdf7dd5298408a10c61dc42f38de47dd605b50cc1b44c9595ad82e774825d",
                "md5":  "b86e19f5c0b6d08e77a6344a639cc168",
                "sha256":  "8a3e2711910ce3679d5d9f4556bdccc0b837097c5fece4d7ff16b7beb84d22a1"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pyjstat-smooth/MAL-2026-16267.json"