MAL-2026-2430

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/k8s-node-health/MAL-2026-2430.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-2430
Published
2026-04-02T15:10:22Z
Modified
2026-04-02T16:01:45.905070Z
Summary
Malicious code in k8s-node-health (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (9358111fecbdb3180b8f4c0c6543abff3024c59deaf488cf3a34089820e96172)

During import, the code download and starts remote executable that later connects to a C2 server, likely establishing a reverse tunnel. After executing the remote binary, the code performs covering-tracks actions by removing the binary from disk, and - depending on version - modifying the package code. The dropper code is either a Python script, or a compiled binary with obfuscated location of the remote binary and config for it.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-03-kube-health-tools

Reasons (based on the campaign):

  • Downloads and executes a remote executable.

  • backdoor

  • obfuscation

  • covering-tracks

Database specific 
{
    "iocs": {
        "domains": [
            "sync.geeker.indevs.in"
        ],
        "urls": [
            "https://github.com/gibunxi4201/kube-node-diag/releases/download/v2.0/kube-diag-linux-amd64-packed"
        ]
    },
    "malicious-packages-origins": [
        {
            "source": "kam193",
            "sha256": "9358111fecbdb3180b8f4c0c6543abff3024c59deaf488cf3a34089820e96172",
            "import_time": "2026-04-02T15:26:55.076528877Z",
            "modified_time": "2026-04-02T15:10:22.524727Z",
            "versions": [
                "1.2.0",
                "1.3.0"
            ],
            "id": "pypi/2026-03-kube-health-tools/k8s-node-health"
        },
        {
            "source": "kam193",
            "sha256": "eec6f580a671df13ae0797f7f2013460180cc47f037a2056cdcc0439c642a68f",
            "import_time": "2026-04-02T15:51:10.427474414Z",
            "modified_time": "2026-04-02T15:10:22.524727Z",
            "versions": [
                "1.2.0",
                "1.3.0"
            ],
            "id": "pypi/2026-03-kube-health-tools/k8s-node-health"
        }
    ]
}
References
Credits

Affected packages

PyPI / k8s-node-health

Package

Name
k8s-node-health
View open source insights on deps.dev
Purl
pkg:pypi/k8s-node-health

Affected ranges

Affected versions

1.*
1.2.0
1.3.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/k8s-node-health/MAL-2026-2430.json"