MAL-2026-18756

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/twitch-stream-py/MAL-2026-18756.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-18756

Published

2026-11-07T23:53:30Z

Modified

2026-11-08T00:45:08Z

Summary

Malicious code in twitch-stream-py (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (bbb2267e685c94eee0456daa9e10960e5cacd1e010a93ecd34c9cd5effe07c9c)

Clone of a legitimate package with injected code that downloads and executes a script from a remote location. During analysis, the remote code was no longer accessible. The campaign was originally discovered by Threx-code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-old-twitch-stream-py

Reasons (based on the campaign):

obfuscation
Downloads and executes a remote malicious script.
clones-real-package
action-hidden-in-lib-usage

Database specific

{
    "iocs": {
        "urls": [
            "https://darkseagreenthornygraduate.wekimi5565.repl.co/script.py"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-11-old-twitch-stream-py/twitch-stream-py",
            "import_time": "2026-11-08T00:33:31.836199555Z",
            "modified_time": "2026-11-07T23:53:30.440096Z",
            "sha256": "bbb2267e685c94eee0456daa9e10960e5cacd1e010a93ecd34c9cd5effe07c9c",
            "source": "kam193",
            "versions": [
                "1.0.2rc0",
                "1.0.3rc0",
                "1.0.4rc0",
                "1.0.4rc2",
                "1.0.5rc2",
                "1.0.6",
                "1.0.7",
                "1.0.8",
                "1.0.9",
                "1.1.0",
                "1.1.1",
                "1.1.2"
            ]
        }
    ]
}

References

Credits

- Kamil Mańkowski (kam193) - REPORTER
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / twitch-stream-py

Package

Name: twitch-stream-py; View open source insights on deps.dev
Purl: pkg:pypi/twitch-stream-py

Affected ranges

Affected versions

1.*

1.0.2rc0

1.0.3rc0

1.0.4rc0

1.0.4rc2

1.0.5rc2

1.0.6

1.0.7

1.0.8

1.0.9

1.1.0

1.1.1

1.1.2

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/twitch-stream-py/MAL-2026-18756.json"