MAL-2026-2310

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/lakeflow-community-connectors/MAL-2026-2310.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-2310

Published

2026-03-31T05:36:24Z

Modified

2026-03-31T06:16:46.037070Z

Summary

Malicious code in lakeflow-community-connectors (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (931d6183e0dc407fb2c14769dcebb7d1845f4af9ca0b26766d75d783b5611165)

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-standard-pypi-install-pentest

Reasons (based on the campaign):

The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.
The package overrides the install command in setup.py to execute malicious code during installation.

Database specific

{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.0.0",
                "0.1.0"
            ],
            "sha256": "931d6183e0dc407fb2c14769dcebb7d1845f4af9ca0b26766d75d783b5611165",
            "import_time": "2026-03-31T06:03:11.170044713Z",
            "modified_time": "2026-03-31T05:36:24.973616Z",
            "id": "pypi/GENERIC-standard-pypi-install-pentest/lakeflow-community-connectors",
            "source": "kam193"
        }
    ]
}

References

https://bad-packages.kam193.eu/pypi/package/lakeflow-community-connectors

Credits

- Kamil Mańkowski (kam193) - REPORTER
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / lakeflow-community-connectors

Package

Name: lakeflow-community-connectors; View open source insights on deps.dev
Purl: pkg:pypi/lakeflow-community-connectors

Affected ranges

Affected versions

0.*

0.0.0

0.1.0

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/lakeflow-community-connectors/MAL-2026-2310.json"