MAL-2026-3805

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/netping/MAL-2026-3805.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-3805
Published
2026-05-16T16:58:22Z
Modified
2026-05-16T17:32:20.802489Z
Summary
Malicious code in netping (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (ecc862a2bc12e6779034a99abd68c5d4ffb047f1fc2ae94407dd9e4ad54df5cf)

The package silently downloads and installs an autostart script that then monitors clipboards and replaces copied cryptowallet adresses.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-netping

Reasons (based on the campaign):

  • persistence

  • crypto-related

  • clipboard-modify

  • Downloads and executes a remote malicious script.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-05-16T17:25:34.505203151Z",
            "versions": [
                "0.2.0",
                "1.1.0"
            ],
            "modified_time": "2026-05-16T17:01:54.939555Z",
            "id": "pypi/2026-05-netping/netping",
            "sha256": "ecc862a2bc12e6779034a99abd68c5d4ffb047f1fc2ae94407dd9e4ad54df5cf",
            "source": "kam193"
        }
    ],
    "iocs": {
        "urls": [
            "https://pastebin.com/raw/dFvWM5Tj"
        ]
    }
}
References
Credits

Affected packages

PyPI / netping

Package

Name
netping
View open source insights on deps.dev
Purl
pkg:pypi/netping

Affected ranges

Affected versions

0.*
0.2.0
1.*
1.1.0

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/netping/MAL-2026-3805.json"