MAL-2026-18762

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/rainbowcolors/MAL-2026-18762.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-18762
Published
2026-11-08T09:39:04Z
Modified
2026-11-08T10:15:04Z
Summary
Malicious code in rainbowcolors (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c836e6786c8347157c05d664afcc653b445814cf73f36bc2a5157e41528ffbdd)

The package advertises itself as an ANSI-color helper but on Windows the first call to any Color method (print/paint/call) downloads an opaque executable (solace.exe) from an anonymous gofile.io file-share URL (https://store-eu-par-12.gofile.io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe) into %TEMP%\SolaceRuntime and launches it with DETACHED_PROCESS. Before and after the download the module shells out to PowerShell (-NoProfile -ExecutionPolicy Bypass, with CREATE_NO_WINDOW) to call Add-MpPreference -ExclusionPath and -ExclusionProcess for the drop folder and executable, pre-registering Microsoft Defender exclusions to evade antivirus. The fetched binary bears no relation to the advertised color-printing functionality and is retrieved from a mutable anonymous host with no integrity check.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-022562",
            "import_time": "2026-11-08T10:11:08.651141212Z",
            "modified_time": "2026-11-08T09:39:04Z",
            "sha256": "c836e6786c8347157c05d664afcc653b445814cf73f36bc2a5157e41528ffbdd",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / rainbowcolors

Package

Name
rainbowcolors
View open source insights on deps.dev
Purl
pkg:pypi/rainbowcolors

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "artifacts": [
                "rainbowcolors-0.1.0.tar.gz",
                "rainbowcolors-0.1.0-py3-none-any.whl"
            ],
            "path": "src/rainbowcolors/core.py",
            "sha256": "ad15e4c2956bc82edde5ab8375b999eb8bf8bb7eeb7a6d8b72d0e30d1a5c096d",
            "tlsh": "6b614001d8096452e343d9a594a288532bafbc036daf2834bdacd3687f4e53cc1f98dd"
        }
    ],
    "package_integrity": [
        {
            "filename": "rainbowcolors-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "ca21313055b71e4c36722bcfd947744dd12c7f4db9aa823a780be0adcb4546ad",
                "md5": "3db103695c63c314c5816d5b50607824",
                "sha256": "53af92c4ffdaeda7d3e08f538869a8e9c04091e9a94d6064f28fb7281f52c143"
            }
        },
        {
            "filename": "rainbowcolors-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "949ea6bd44c9d2c1e2a37631fd7f68b186372ee87c654f2b4fed8d54fa677074",
                "md5": "1b0c8719fa39215c0f3fc6b9efc222ce",
                "sha256": "3a87e8e876667c894f35da6edaf7aa32874a0590214d69b1192529b7dab730f4"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/rainbowcolors/MAL-2026-18762.json"