MAL-2026-18223

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/brambletask/MAL-2026-18223.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18223
Published
2026-10-23T15:52:50Z
Modified
2026-10-29T14:45:10Z
Summary
Malicious code in brambletask (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (bed3c7b9b467652f58bd7ff55383900d1e7fbe73c1acbce4c79e12040b96ce9f)

Analysis of brambletask 0.1.0 on PyPI surfaced no indicators of supply-chain attack behavior. No install-time or import-time network activity, no credential or filesystem harvesting, no fetch-and-execute of remote content, and no persistence or backdoor mechanisms were observed in the package's shipped files.

Source: kam193 (922435cd67a39583e0143229da6822f691940fcea9f4b4b18203faa594a1debc)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • other

  • Downloads and executes a remote malicious script.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-10-voice-synthesis-profiles/brambletask",
            "import_time": "2026-10-23T16:20:13.974894613Z",
            "modified_time": "2026-10-23T15:52:50.580129Z",
            "sha256": "922435cd67a39583e0143229da6822f691940fcea9f4b4b18203faa594a1debc",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-022314",
            "import_time": "2026-10-29T14:37:03.476151247Z",
            "modified_time": "2026-10-29T14:16:42Z",
            "sha256": "bed3c7b9b467652f58bd7ff55383900d1e7fbe73c1acbce4c79e12040b96ce9f",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / brambletask

Package

Name
brambletask
View open source insights on deps.dev
Purl
pkg:pypi/brambletask

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "package_integrity": [
        {
            "filename": "brambletask-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "8b5fec6d9bb99dce5d79bfce52a829789ec9b58b8846b5ddfc2d4f36587a67a5",
                "md5": "6b106bc964aed1d766e9abed5fe5f249",
                "sha256": "a3f4500bb1ff1058ac8689877e8fa37955be2270c26890180ea1424349f5f94a"
            }
        },
        {
            "filename": "brambletask-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "f089d8ff1880fc449ef3511887972952b72055fc5b5bb90edf76d44f280c8678",
                "md5": "ba3e4b3c57b393695419e3c573c94e40",
                "sha256": "ca8823bcc40be991e57952ba834f1bc1b3903d1cc40c298cd915e5d0ca122526"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/brambletask/MAL-2026-18223.json"