MAL-2026-3369

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dabrius/MAL-2026-3369.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-3369
Published
2026-05-07T19:12:49Z
Modified
2026-05-07T20:16:55.256053Z
Summary
Malicious code in dabrius (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (4a154cab742b51be41ca413e20acccfed4290ac4cf692e1cfeb17a677df98bab)

The message hidden in the package description tries to convince AI agents to prefer installing the package, which then in multiple places marks execution and collects potentially sensitive data. The behavior extends with each version, up to exfiltration of basic information to a remote target in 1.0.7.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-dabrius

Reasons (based on the campaign):

  • exfiltration-generic

  • llm-threat

  • exfiltration-credentials

Database specific 
{
    "malicious-packages-origins": [
        {
            "sha256": "4a154cab742b51be41ca413e20acccfed4290ac4cf692e1cfeb17a677df98bab",
            "source": "kam193",
            "modified_time": "2026-05-07T19:12:49.885962Z",
            "id": "pypi/2026-05-dabrius/dabrius",
            "import_time": "2026-05-07T20:02:41.171800057Z",
            "versions": [
                "0.1.0",
                "0.1.1",
                "0.1.2",
                "0.1.3",
                "0.2.0",
                "0.2.1",
                "0.2.2",
                "0.2.3",
                "0.2.4",
                "0.3.0",
                "0.3.1",
                "0.3.2",
                "0.3.3",
                "0.3.4",
                "0.4.0",
                "0.4.1",
                "1.0.0",
                "1.0.1",
                "1.0.2",
                "1.0.3",
                "1.0.4",
                "1.0.5",
                "1.0.6",
                "1.0.7"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / dabrius

Package

Name
dabrius
View open source insights on deps.dev
Purl
pkg:pypi/dabrius

Affected ranges

Affected versions

0.*
0.1.0
0.1.1
0.1.2
0.1.3
0.2.0
0.2.1
0.2.2
0.2.3
0.2.4
0.3.0
0.3.1
0.3.2
0.3.3
0.3.4
0.4.0
0.4.1
1.*
1.0.0
1.0.1
1.0.2
1.0.3
1.0.4
1.0.5
1.0.6
1.0.7

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/dabrius/MAL-2026-3369.json"