MAL-2026-17180

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/my-private-pkg/MAL-2026-17180.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17180
Published
2026-09-25T00:08:08Z
Modified
2026-09-25T07:30:04Z
Summary
Malicious code in my-private-pkg (PyPI)
Details

Version 99.1.1 of my-private-pkg executes a custom setuptools install hook while a wheel is built. The hook launches my_private_pkg/index.py, which collects the current username, working directory, hostname, resolved local IP address, operating system, and machine architecture, then attempts to POST the resulting JSON to a hard-coded Webhook.site request collector. Dynamic analysis observed the wheel build spawn this script followed immediately by network activity. The package's public metadata describes it only as a private Python package and does not disclose the collection or transmission.

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (d8008c5637dfae2dfc4162f1dd5152c5e90e03b0fc8593fda5055f44e9745b22)

setup.py registers a custom install command (PostInstallCommand) that runs my_private_pkg/index.py automatically on pip install. That script gathers installer-side identifiers — os.getlogin(), socket.gethostname(), local IP address, os.getcwd(), platform.system() and platform.machine() — and POSTs them as JSON to a hardcoded collector URL at https://webhook.site/d4d1b01b-708a-40b9-b8c8-187eeecafeed. A duplicate of the exfiltration payload is shipped as vercel_runtime_python/index.py, and vercel_runtime_python/init.py contains the same PostInstallCommand wiring referencing my_private_pkg/index.py; the module name mimics Vercel's Python runtime. The package name and the internal vercel_runtime_python module name are consistent with a dependency-confusion lure targeting an internal my-private-pkg name and Vercel's runtime namespace: the only on-install effect is a reconnaissance beacon to an attacker-controlled webhook.site endpoint identifying the host that mistakenly resolved the public name.

Source: kam193 (b9272fe1642ca0e3b8b1cfcf930ca69b08119ed258cdc760f9ad8a014b76767b)

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-standard-pypi-install-pentest

Reasons (based on the campaign):

  • The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

  • The package overrides the install command in setup.py to execute malicious code during installation.

Database specific 
{
    "iocs":  {
        "domains":  [
            "webhook.site"
        ],
        "urls":  [
            "https://webhook.site/d4d1b01b-708a-40b9-b8c8-187eeecafeed"
        ]
    },
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020555",
            "import_time":  "2026-09-25T02:45:29.227169648Z",
            "modified_time":  "2026-09-25T02:42:27Z",
            "sha256":  "d8008c5637dfae2dfc4162f1dd5152c5e90e03b0fc8593fda5055f44e9745b22",
            "source":  "amazon-inspector",
            "versions":  [
                "99.1.1"
            ]
        },
        {
            "id":  "pypi/GENERIC-standard-pypi-install-pentest/my-private-pkg",
            "import_time":  "2026-09-25T07:22:49.82314231Z",
            "modified_time":  "2026-09-25T06:04:29.410889Z",
            "sha256":  "b9272fe1642ca0e3b8b1cfcf930ca69b08119ed258cdc760f9ad8a014b76767b",
            "source":  "kam193",
            "versions":  [
                "0.1.1",
                "99.1.1",
                "99.11.2"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / my-private-pkg

Package

Name
my-private-pkg
View open source insights on deps.dev
Purl
pkg:pypi/my-private-pkg

Affected ranges

Affected versions

0.*
0.1.1
99.*
99.1.1
99.11.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "setup.py",
            "sha256":  "8cd83903e488634d917bbfffe4c6cc989888004a7de19e35509885041df42a32",
            "tlsh":  "3e01bd47ce7593342c7243aa95962501e722166b1b00a48b30fe05185f73862851fbef"
        },
        {
            "path":  "vercel_runtime_python/index.py",
            "sha256":  "df6d2c082b08ac77ebe3c6a8db9b2fd9dc607482631224fd120502de81191934",
            "tlsh":  "5611cc7a8d618d41977a808ccc078092f2164b236b25fe6bbcfc066daf3000153b0df2"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "my_private_pkg-99.1.1-py3-none-any.whl",
            "hashes":  {
                "blake2b_256":  "6120ed17fac654a5d8e73c68eb5e9ddebe7fa298fc85347e3d656eca67856e0a",
                "md5":  "cb7f60550698225c587033bcf99024d7",
                "sha256":  "17d77e31dceb38fde6c20c70164515acf24e2e334f9d22858f771cce78594aa8"
            }
        },
        {
            "filename":  "my_private_pkg-99.1.1.tar.gz",
            "hashes":  {
                "blake2b_256":  "efb0b5cbed785b116759e99b6712106011d810418c9b388dace6d9426f34611b",
                "md5":  "ba6ed08758ab5071a9d04458a21e05e0",
                "sha256":  "c23d1aefbf0580324d8a4b1caf5c862c7a4146c5c797d5dbc84bb5e37a9ddb4d"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/my-private-pkg/MAL-2026-17180.json"