MAL-2026-19202
See a problem?- Import Source
- https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dashloom/MAL-2026-19202.json
- JSON Data
- https://api.osv.dev/v1/vulns/MAL-2026-19202
- Published
- 2026-11-12T22:25:26Z
- Modified
- 2026-11-12T23:15:03Z
- Summary
- Malicious code in dashloom (PyPI)
- Details
-
-= Per source details. Do not edit below this line.=-
Source: kam193 (ba0285d49d46cd93cdcad1582bb1c013beb3791dc901a0a3c96f3801dba9d909)
This package is prepared to be used as a malicious loader. It pins pydash dependency in a vulnerable version allowing reaching out of the object scope when calling
pydash.invoke(...). The code to reach it is intended to be delivered from the now-benign GitHub file, which is then splited and passed to the vulnerable function. The same Github user account is also involved in publishing a repository that executes embedded encrypted code when called with specific arguments. The package was originally flagged by PyPI Security.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-dashloom
Reasons (based on the campaign):
-
action-hidden-in-lib-usage
-
Downloads and executes a remote malicious script.
-
- Database specific
{ "iocs": { "urls": [ "https://github.com/dash-loom/dashloom-helper/blob/main/src/dashloom_helper/helper.txt" ] }, "malicious-packages-origins": [ { "id": "pypi/2026-11-dashloom/dashloom", "import_time": "2026-11-12T23:09:52.557746197Z", "modified_time": "2026-11-12T22:25:26.740092Z", "sha256": "ba0285d49d46cd93cdcad1582bb1c013beb3791dc901a0a3c96f3801dba9d909", "source": "kam193", "versions": [ "1.0.0", "1.1.0", "1.1.1" ] } ] }- References
- Credits
-
-
- Kamil Mańkowski (kam193) - REPORTER
-
Affected packages
PyPI / dashloom
Package
- Name
- dashloom
- View open source insights on deps.dev
- Purl
- pkg:pypi/dashloom