MAL-2026-2400

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/kube-node-health/MAL-2026-2400.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-2400
Published
2026-04-01T11:46:16Z
Modified
2026-04-22T11:48:48.121629Z
Summary
Malicious code in kube-node-health (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (391555cff14c82156843bee267daf896c3e3e989b9c899ef34b12ac7e23b1c7e)

During import, the code download and starts remote executable that later connects to a C2 server, likely establishing a reverse tunnel. After executing the remote binary, the code performs covering-tracks actions by removing the binary from disk, and - depending on version - modifying the package code. The dropper code is either a Python script, or a compiled binary with obfuscated location of the remote binary and config for it.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-03-kube-health-tools

Reasons (based on the campaign):

  • Downloads and executes a remote executable.

  • backdoor

  • obfuscation

  • covering-tracks

Database specific 
{
    "iocs": {
        "urls": [
            "https://github.com/gibunxi4201/kube-node-diag/releases/download/v2.0/kube-diag-linux-amd64-packed"
        ],
        "domains": [
            "sync.geeker.indevs.in"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-03-kube-health-tools/kube-node-health",
            "import_time": "2026-04-01T12:26:29.203893088Z",
            "sha256": "391555cff14c82156843bee267daf896c3e3e989b9c899ef34b12ac7e23b1c7e",
            "source": "kam193",
            "modified_time": "2026-04-01T11:46:16.456425Z",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "pypi/2026-03-kube-health-tools/kube-node-health",
            "import_time": "2026-04-22T11:28:51.297614234Z",
            "sha256": "4777264b720c2b41fc408aea73a5f6968b36bbc5cc8f621cf2e7feed750f7421",
            "source": "kam193",
            "modified_time": "2026-04-01T11:46:16.456425Z",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / kube-node-health

Package

Name
kube-node-health
View open source insights on deps.dev
Purl
pkg:pypi/kube-node-health

Affected ranges

Affected versions

1.*
1.0.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/kube-node-health/MAL-2026-2400.json"