MAL-2026-17884

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/getpubip/MAL-2026-17884.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17884
Published
2026-10-15T10:13:20Z
Modified
2026-10-26T19:00:41Z
Summary
Malicious code in getpubip (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (6d316a35a6fe335032b2c59e47627c0af28bec9688cba40585f1365cab4f4452)

getpubip/init.py runs exec() on an approximately 2KB opaque payload produced by reversing a string literal, base64-decoding it, and zlib-decompressing it (lambda : import('zlib').decompress(import('base64').b64decode([::-1])); exec(_(b'...'))). The package advertises itself as a three-line helper that returns the host's public IP by calling ipify, and a clean implementation of that functionality exists in core.py; init.py does not re-export get_ip and its only effect on import is to execute the hidden blob. The payload is reached whenever a consumer runs import getpubip or python -m getpubip, so any installer that uses the package executes the concealed code with no further user action. The triple-layered obfuscation (string reverse, base64, zlib) and single-character identifiers are deliberately chosen to hide the executed code from reviewers; whatever the decoded bytes do runs in the installer's process on first import.

Source: kam193 (6a07d6dd387bbd88252ffdda7f8c10daf988f0622250daf20e7ec8ee0f63c6d5)

During import, obfuscated code downloads and executes an infostealer. Campaign shares some similarities with the campaign 2026-10-fontcase.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-getpubip

Reasons (based on the campaign):

  • Downloads and executes a remote executable.

  • infostealer

  • exfiltration-browser-data

  • obfuscation

Database specific 
{
    "iocs": {
        "domains": [
            "api-bsx.pages.dev"
        ],
        "urls": [
            "https://api-bsx.pages.dev/download"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-getpubip/getpubip",
            "import_time": "2026-10-15T10:43:09.275286028Z",
            "modified_time": "2026-10-15T10:13:20.123974Z",
            "sha256": "6a07d6dd387bbd88252ffdda7f8c10daf988f0622250daf20e7ec8ee0f63c6d5",
            "source": "kam193",
            "versions": [
                "0.1.0",
                "0.1.1",
                "0.1.2"
            ]
        },
        {
            "id": "IN-MAL-2026-021819",
            "import_time": "2026-10-26T18:56:20.850159877Z",
            "modified_time": "2026-10-26T18:37:24Z",
            "sha256": "6d316a35a6fe335032b2c59e47627c0af28bec9688cba40585f1365cab4f4452",
            "source": "amazon-inspector",
            "versions": [
                "0.1.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / getpubip

Package

Name
getpubip
View open source insights on deps.dev
Purl
pkg:pypi/getpubip

Affected ranges

Affected versions

0.*
0.1.0
0.1.1
0.1.2

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "getpubip/__init__.py",
            "sha256": "737351e320abeac2e656790d650c87565aa13e79460552d7162d77b779e42b40",
            "tlsh": "35618efeafe46ca7f9610b6dc3418884218749057616b204c9bedbfb577203035c1b17"
        }
    ],
    "package_integrity": [
        {
            "filename": "getpubip-0.1.1-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "609397a624483c8b7321c4a152e20b83e79e184a574bf40d13ea53ef4beb1f7f",
                "md5": "ed3967f1d812ff61faf3d2bd2edea7d4",
                "sha256": "9b7cbdb0e2de96076ef7f8dfe87012e467b3a84b170e241842149bce8387ef68"
            }
        },
        {
            "filename": "getpubip-0.1.1.tar.gz",
            "hashes": {
                "blake2b_256": "f1cf3bba655290fe7f189a171f3fd1e5a31ed7fc6e71b692dbe3444ed2bd20de",
                "md5": "aaece4ec17b372ae98e65814d0d09538",
                "sha256": "92288e33cce14f3318a1741bdae091c53e2e21086f231a9a8cf129a135de112e"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/getpubip/MAL-2026-17884.json"