MAL-2026-2948

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/leavemealone/MAL-2026-2948.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-2948
Published
2026-04-20T08:39:35Z
Modified
2026-04-20T09:49:40.420767Z
Summary
Malicious code in leavemealone (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (5628eb1d01e8eb7de8a582cd9ea85dff68eafde06f4e1164ae92842354db0bf7)

During building the package, it executes encrypted code. The content is unclear as the decryption key bases on the local environment variable. Given leaving a "flag" file at the end, this package can also be part of a CTF-like exercise, but it's not possible to be sure given the encrypted payload.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-04-leavemealone

Reasons (based on the campaign):

  • obfuscation
Database specific 
{
    "malicious-packages-origins": [
        {
            "modified_time": "2026-04-20T08:39:35.545786Z",
            "versions": [
                "0.1.1",
                "0.1.2"
            ],
            "sha256": "5628eb1d01e8eb7de8a582cd9ea85dff68eafde06f4e1164ae92842354db0bf7",
            "id": "pypi/2026-04-leavemealone/leavemealone",
            "source": "kam193",
            "import_time": "2026-04-20T09:41:09.783192644Z"
        }
    ]
}
References
Credits

Affected packages

PyPI / leavemealone

Package

Name
leavemealone
View open source insights on deps.dev
Purl
pkg:pypi/leavemealone

Affected ranges

Affected versions

0.*
0.1.1
0.1.2

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/leavemealone/MAL-2026-2948.json"