MAL-2026-18735

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hello-bat-fwi9/MAL-2026-18735.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18735
Published
2026-11-06T20:33:22Z
Modified
2026-11-06T21:15:02Z
Summary
Malicious code in hello-bat-fwi9 (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (915b488501776e1dc1f9c551e0a52310fc6daa8a299b0638f6d5d7f615d1ad8b)

The package delivers an obfuscated .bat file delivering a RAT, with the help of its own Python runtime and PTH files. The code requires manually triggering the malicious action. This is most likely a continuation of the campaign 2026-11-filipt.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-hello-bat-fwi9

Reasons (based on the campaign):

  • obfuscation

  • rat

  • abuses-pth

  • malware

Database specific 
{
    "iocs": {
        "domains": [
            "r931vmql.free.tryportwarp.cc"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-11-hello-bat-fwi9/hello-bat-fwi9",
            "import_time": "2026-11-06T21:10:24.246377794Z",
            "modified_time": "2026-11-06T20:33:22.583976Z",
            "sha256": "915b488501776e1dc1f9c551e0a52310fc6daa8a299b0638f6d5d7f615d1ad8b",
            "source": "kam193",
            "versions": [
                "0.1.0",
                "0.1.1"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / hello-bat-fwi9

Package

Name
hello-bat-fwi9
View open source insights on deps.dev
Purl
pkg:pypi/hello-bat-fwi9

Affected ranges

Affected versions

0.*
0.1.0
0.1.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hello-bat-fwi9/MAL-2026-18735.json"