MAL-2026-2431

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/nwin32tls/MAL-2026-2431.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-2431
Published
2026-04-02T20:26:19Z
Modified
2026-04-02T21:06:29.403909Z
Summary
Malicious code in nwin32tls (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (a47778618cad57dbc584afdff7ed138032b69c423a9812e1bc8f86c13129f01d)

Importing the module starts a loop that listens to key strokes and on every capslock press exfiltrates screenshot to a hardcoded location.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-04-old-nwin32tls

Reasons (based on the campaign):

  • spyware-like
Database specific 
{
    "malicious-packages-origins": [
        {
            "versions": [
                "0.0.1",
                "0.0.2",
                "0.0.3",
                "0.0.5",
                "0.0.6",
                "0.0.7"
            ],
            "source": "kam193",
            "import_time": "2026-04-02T20:47:26.849020058Z",
            "modified_time": "2026-04-02T20:26:19.105445Z",
            "id": "pypi/2026-04-old-nwin32tls/nwin32tls",
            "sha256": "a47778618cad57dbc584afdff7ed138032b69c423a9812e1bc8f86c13129f01d"
        }
    ]
}
References
Credits

Affected packages

PyPI / nwin32tls

Package

Name
nwin32tls
View open source insights on deps.dev
Purl
pkg:pypi/nwin32tls

Affected ranges

Affected versions

0.*
0.0.1
0.0.2
0.0.3
0.0.5
0.0.6
0.0.7

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/nwin32tls/MAL-2026-2431.json"