MAL-2026-18153

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hookgantry/MAL-2026-18153.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18153
Published
2026-10-22T00:21:46Z
Modified
2026-10-29T14:45:07Z
Summary
Malicious code in hookgantry (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bc8005889d1341b2a59a879ac055990fc071ea11c67093f04f88ebf15caeb90e)

The package hookgantry 0.1.0 was scanned and no indicators of installer-side harm were found. There is no evidence of install-time or import-time network activity, no credential or environment harvesting, no fetch-and-execute dropper, no silent relay of caller data, and no persistence mechanism.

Source: kam193 (8f2adef4202c047248aedfecfea60e5c71798b9a9f15999a7f9c76e6a5471dab)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • Downloads and executes a remote malicious script.

  • other

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/hookgantry",
            "import_time": "2026-10-22T00:45:02.487291655Z",
            "modified_time": "2026-10-22T00:21:46.826269Z",
            "sha256": "8f2adef4202c047248aedfecfea60e5c71798b9a9f15999a7f9c76e6a5471dab",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/hookgantry",
            "import_time": "2026-10-22T01:26:38.725553091Z",
            "modified_time": "2026-10-22T00:21:46.826269Z",
            "sha256": "c5c653f32d0d944c1f955a437e55ac24ef1ec527e0a4e74fb76bd2513b8f6822",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022401",
            "import_time": "2026-10-29T14:37:07.284712278Z",
            "modified_time": "2026-10-29T14:28:00Z",
            "sha256": "bc8005889d1341b2a59a879ac055990fc071ea11c67093f04f88ebf15caeb90e",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/hookgantry",
            "import_time": "2026-10-29T14:37:09.28537542Z",
            "modified_time": "2026-10-22T00:21:46.826269Z",
            "sha256": "936892c6adbdb7250fec9b0c75f01946cc92a201e5f7fae7bdb6c17d0732ddbe",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / hookgantry

Package

Name
hookgantry
View open source insights on deps.dev
Purl
pkg:pypi/hookgantry

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "hookgantry-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "e77120d44661ceee744195c7b65353396eea4da7259074d8a01982368cfba70f",
                "md5": "3559dd4433ca750d33d8c84f5b5b6420",
                "sha256": "e3d5126d9364b67ddeb18bb364d870db289e6f363088d09dd11fd2029ec10140"
            }
        },
        {
            "filename": "hookgantry-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "e4e667f5c434707a3f26d348d10cc42fde11d1fec7897cf1f07f233bb588aa15",
                "md5": "9c388468cf17bff0132aef7e29fbb279",
                "sha256": "38a919c0c722100e168666ae107f6eb0fb91f4c71622b57cf6118477f13fc746"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hookgantry/MAL-2026-18153.json"