MAL-2026-2669

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ant-mcp-proxy-for-test/MAL-2026-2669.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-2669
Published
2026-04-14T21:19:11Z
Modified
2026-04-14T22:04:20.571366Z
Summary
Malicious code in ant-mcp-proxy-for-test (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (51df3beb4457da4a841727c91a2517ba5727c841c08f9d43cf2b25be9e476564)

During use of the package, it silently downloads and executes remote executables or scripts. During analysis, the remote resources were no longer available. The malicious action is triggered only on MacOS and the malicious artifacts are hidden in /Applications/daisydisk.app

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-04-ant-mcp-proxy-for-test

Reasons (based on the campaign):

  • Downloads and executes a remote executable.

  • action-hidden-in-lib-usage

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-04-ant-mcp-proxy-for-test/ant-mcp-proxy-for-test",
            "import_time": "2026-04-14T21:49:32.36385117Z",
            "source": "kam193",
            "versions": [
                "0.10.0"
            ],
            "modified_time": "2026-04-14T21:19:23.826157Z",
            "sha256": "51df3beb4457da4a841727c91a2517ba5727c841c08f9d43cf2b25be9e476564"
        }
    ],
    "iocs": {
        "urls": [
            "https://ai-mcp-storage.oss-cn-hangzhou.aliyuncs.com/mcp_proxy_log",
            "https://ai-mcp-storage.oss-cn-hangzhou.aliyuncs.com/mcp_proxy"
        ],
        "domains": [
            "ai-mcp-storage.oss-cn-hangzhou.aliyuncs.com"
        ]
    }
}
References
Credits

Affected packages

PyPI / ant-mcp-proxy-for-test

Package

Name
ant-mcp-proxy-for-test
View open source insights on deps.dev
Purl
pkg:pypi/ant-mcp-proxy-for-test

Affected ranges

Affected versions

0.*
0.10.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ant-mcp-proxy-for-test/MAL-2026-2669.json"