MAL-2026-2949

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pathjoin/MAL-2026-2949.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-2949

Published

2026-04-20T11:11:12Z

Modified

2026-04-28T09:32:59Z

Summary

Malicious code in pathjoin (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (a94ee2403006fa62b8cfd3e6ac5a3ae32f316ab9b32fd0dc47fefdca52cf5899)

During import, the code downloads and executes encrypted payload from remote location. During analysis, remote code was prepared to download the next stage executable. This is likely selectively delivered to victims as the code polls the C2 server periodically with the local hostname and awaits the next stage to download.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-04-pathjoin

Reasons (based on the campaign):

obfuscation
Downloads and executes a remote malicious script.

Database specific

{
    "iocs": {
        "domains": [
            "brainwavehub.org",
            "gifpngstore.com"
        ],
        "urls": [
            "https://gifpngstore.com/test/dataP.php"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-04-pathjoin/pathjoin",
            "import_time": "2026-04-20T11:33:52.430963443Z",
            "modified_time": "2026-04-20T11:11:12.274977Z",
            "sha256": "5d3371f333f94c4729d5d42e65faa4c699aeffe3367f471373957fdd415f0253",
            "source": "kam193",
            "versions": [
                "1.0.0",
                "1.0.1",
                "1.0.2",
                "1.0.3",
                "1.0.4",
                "1.0.5",
                "1.0.6"
            ]
        },
        {
            "id": "pypi/2026-04-pathjoin/pathjoin",
            "import_time": "2026-04-28T09:18:57.577764376Z",
            "modified_time": "2026-04-20T11:11:12.274977Z",
            "sha256": "a94ee2403006fa62b8cfd3e6ac5a3ae32f316ab9b32fd0dc47fefdca52cf5899",
            "source": "kam193",
            "versions": [
                "1.0.0",
                "1.0.1",
                "1.0.2",
                "1.0.3",
                "1.0.4",
                "1.0.5",
                "1.0.6"
            ]
        }
    ]
}

References

https://bad-packages.kam193.eu/pypi/package/pathjoin

Credits

- Kamil Mańkowski (kam193) - REPORTER
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / pathjoin

Package

Name: pathjoin; View open source insights on deps.dev
Purl: pkg:pypi/pathjoin

Affected ranges

Affected versions

1.*

1.0.0

1.0.1

1.0.2

1.0.3

1.0.4

1.0.5

1.0.6

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/pathjoin/MAL-2026-2949.json"