MAL-2026-18222

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/badgertask/MAL-2026-18222.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18222
Published
2026-10-23T15:52:43Z
Modified
2026-10-29T14:30:33Z
Summary
Malicious code in badgertask (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dec1f79725a3b93471456baaf9c5b4ea9b889270fb5526070a136c1c9e06b08c)

Analysis of badgertask 0.1.0 produced no findings indicating installer-side harm. No install-time or import-time network activity, credential or environment scraping, filesystem persistence outside the package's own directory, obfuscated payloads, or outbound connections to attacker-controlled destinations were observed in the shipped files.

Source: kam193 (ad613b4be626131dbf5d5cdd0e6d63ca39c89165c96fe7fd152d8d781c4573ba)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • other

  • Downloads and executes a remote malicious script.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/badgertask",
            "import_time": "2026-10-23T16:20:13.968295346Z",
            "modified_time": "2026-10-23T15:52:43.678003Z",
            "sha256": "ad613b4be626131dbf5d5cdd0e6d63ca39c89165c96fe7fd152d8d781c4573ba",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022215",
            "import_time": "2026-10-29T14:14:35.009358614Z",
            "modified_time": "2026-10-29T14:03:50Z",
            "sha256": "dec1f79725a3b93471456baaf9c5b4ea9b889270fb5526070a136c1c9e06b08c",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / badgertask

Package

Name
badgertask
View open source insights on deps.dev
Purl
pkg:pypi/badgertask

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "badgertask-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "e67b281059b58f1387fa7ff439d7075d82a94d0eb9ef5e33f03901739f1578ba",
                "md5": "6eb00d90183f3558c2ec569d50f90645",
                "sha256": "01707a37433bcfe58f2c269128d6fe998d1d51b5ce8abc3b105e5b3c39d2fd7c"
            }
        },
        {
            "filename": "badgertask-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "6abf4baf4291b6f7e58fe66c8ec34ee81bdd744516bb9a45b440896aae31fb0a",
                "md5": "1315dd1c9c630b3a78ce7bbed38d8bf6",
                "sha256": "fb0e29b459053d9903c478637cb13f826de9fb2f6919c6e5d500e8ae049b46b6"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/badgertask/MAL-2026-18222.json"