MAL-2026-18406

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/stdid-nyxprobe/MAL-2026-18406.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18406
Published
2026-10-30T10:03:06Z
Modified
2026-10-30T12:45:13Z
Summary
Malicious code in stdid-nyxprobe (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (2ccf3f03f309715ca11fb3863aa89a57d4c0550606cb17839bfff9b5dfd34687)

The package installs stdid_nyxprobe.pth into site-packages, whose sole content is import stdid_nyxprobe._beacon. Python's site.py mechanism evaluates this on every interpreter start after pip install, with no user-initiated import required. The imported module stdid_nyxprobe/_beacon.py collects host identifiers — hostname (socket.gethostname), LAN IP (via hostname -I), username (getpass.getuser), current working directory, and Python version — and POSTs them to https://api.telegram.org/bot/sendMessage using a hardcoded bot token (8984095380:AAHN...) and two hardcoded chat IDs (1841775463, -5380294525). A sentinel file at ~/.cache/.stdid_beacon_fired is written to suppress repeat beacons. The package has no documented legitimate functionality that would justify this behavior; the.pth auto-exec primitive is being used purely as a persistence/auto-trigger vector for the exfiltration payload.

Source: kam193 (0178d6c7a642f90327546548a88f64bd17da5aa97e519249f515c0e6232c73f1)

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-standard-pypi-install-pentest

Reasons (based on the campaign):

  • The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

  • The package overrides the install command in setup.py to execute malicious code during installation.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "pypi/GENERIC-standard-pypi-install-pentest/stdid-nyxprobe",
            "import_time":  "2026-10-30T10:13:02.408406079Z",
            "modified_time":  "2026-10-30T10:03:06.781216Z",
            "sha256":  "0178d6c7a642f90327546548a88f64bd17da5aa97e519249f515c0e6232c73f1",
            "source":  "kam193",
            "versions":  [
                "0.0.1",
                "0.0.2"
            ]
        },
        {
            "id":  "IN-MAL-2026-022422",
            "import_time":  "2026-10-30T12:42:29.579464666Z",
            "modified_time":  "2026-10-30T12:28:26Z",
            "sha256":  "2ccf3f03f309715ca11fb3863aa89a57d4c0550606cb17839bfff9b5dfd34687",
            "source":  "amazon-inspector",
            "versions":  [
                "0.0.2"
            ]
        },
        {
            "id":  "IN-MAL-2026-022445",
            "import_time":  "2026-10-30T12:42:31.35916659Z",
            "modified_time":  "2026-10-30T12:31:13Z",
            "sha256":  "bc11a41bf569b62e65aa2a2913e3659c51a97ea1798c09e4d3ecef58add76e52",
            "source":  "amazon-inspector",
            "versions":  [
                "0.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / stdid-nyxprobe

Package

Name
stdid-nyxprobe
View open source insights on deps.dev
Purl
pkg:pypi/stdid-nyxprobe

Affected ranges

Affected versions

0.*
0.0.1
0.0.2

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    },
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "stdid_nyxprobe/_beacon.py",
            "sha256":  "7b7e6f6c8a850c6aa43bad42a14e96233fe553f8a508a8eb47da63e4cc827f73",
            "tlsh":  "f73114d1f82258f6e68bc194882085b436636907a513ec35fdee53106fcb0b1c172bba"
        },
        {
            "path":  "stdid_nyxprobe.pth",
            "sha256":  "b7c973a0d907af04947d86520e358e58455c5d9fc1ee3a19370732ef69f58250"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "stdid_nyxprobe-0.0.2-py3-none-any.whl",
            "hashes":  {
                "blake2b_256":  "26a61ce72eb0845c847f218584cf740059387cb7ce69493e281e5103f640310b",
                "md5":  "5e4fb8988b0d57ed75b257a9aac006db",
                "sha256":  "8e089256555a08787fd573dc2f97b388630df7f2391e4ecabeeb1e22dfa6ac8d"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/stdid-nyxprobe/MAL-2026-18406.json"