MAL-2026-19051

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/shanks/MAL-2026-19051.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-19051

Published

2026-11-07T03:16:10Z

Modified

2026-11-09T23:15:34Z

Summary

Malicious code in shanks (PyPI)

Details

The module shanks/shanks.py, when imported, looks up the machine's public IP address and location from a geolocation service and posts the IP address, city, state, postal code, latitude and longitude, with an @everyone mention, to a hard-coded Discord webhook. The package describes itself only as "A small example pkg". Version examined: 0.0.4; sdist SHA-256 dc417305d4b083a60ffda7aa310952306258fc12afc536a0641fc4a79c95bed8.

Credits

- Cordon Security, Inc. - FINDER
- - https://cordonscan.com
  - https://github.com/Threx-code/cordon
- Oluwatosin Amokeodo - FINDER
- - mailto:oluwatosin.amokeodo@gmail.com
  - https://www.linkedin.com/in/oluwatosin-amokeodo/

Affected packages

PyPI / shanks

Package

Name: shanks; View open source insights on deps.dev
Purl: pkg:pypi/shanks

Affected ranges

Affected versions

0.*

0.0.4

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/shanks/MAL-2026-19051.json"