MAL-2026-5272

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/goodoltoulas/MAL-2026-5272.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-5272
Published
2026-06-05T19:06:34Z
Modified
2026-06-12T20:02:00Z
Summary
Malicious code in goodoltoulas (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (98a84d10e07878c98ffa21b3920940b10ffac4d3cdd66250c046391ea502aaff)

On pip install goodoltoulas, setup.py unconditionally invokes setup_helper(), which downloads an opaque PE binary from an anonymous file-hosting service (storage.filebin.net) into C:\MALWARE_DELETE\main.exe and launches it via subprocess.Popen with CREATE_NEW_CONSOLE. There is no hash check, signature verification, or version pinning, and the host is unrelated to any package publisher. The library surface is a thin decoy: init.py forwards all attribute access to the requests module and the README advertises 'A simple request cloner for Python', providing cover for the install-time dropper. The drop path uses a self-incriminating directory name (C:\MALWARE_DELETE) and the response carries application/vnd.microsoft.portable-executable, confirming hostile intent. Any Windows installer running pip install will execute attacker-controlled code immediately.

Source: kam193 (d1279e2d267bf2af95bf5c3a98cc71ac362ed2af7aa35f6bbfe1f05bb839cb18)

During installation, package attempts to download and run an executable imitating malicious activity.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: 2026-06-goodoldtoulas

Reasons (based on the campaign):

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • Downloads and executes a remote executable.

Database specific 
{
    "iocs": {
        "urls": [
            "https://cold-eu-par-1.gofile.io/download/web/deb39e07-da2d-4081-a86b-6380e555788c/main.exe"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-06-goodoldtoulas/goodoltoulas",
            "import_time": "2026-06-05T20:11:44.760252838Z",
            "modified_time": "2026-06-05T19:06:35.125485Z",
            "sha256": "d1279e2d267bf2af95bf5c3a98cc71ac362ed2af7aa35f6bbfe1f05bb839cb18",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-006185",
            "import_time": "2026-06-12T19:44:17.608821008Z",
            "modified_time": "2026-06-12T19:10:50Z",
            "sha256": "98a84d10e07878c98ffa21b3920940b10ffac4d3cdd66250c046391ea502aaff",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-006186",
            "import_time": "2026-06-12T19:44:17.697615511Z",
            "modified_time": "2026-06-12T19:10:50Z",
            "sha256": "ee2ef27464f7f6b4aa1b5615a42ebd130e31cf169a4f3396656108d63a326b1b",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / goodoltoulas

Package

Name
goodoltoulas
View open source insights on deps.dev
Purl
pkg:pypi/goodoltoulas

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "domains": [
        "storage.filebin.net"
    ],
    "evidence_files": [
        {
            "path": "setup.py",
            "sha256": "5d4bf30c6967d269a6ab169902074c7b8f409800162f543c45665f91137f45a0",
            "tlsh": "7431b5aece0010909382bd182e8389ad257bb123bb63e4e53d9c41503fc9295d3d355e"
        },
        {
            "path": "goodoltoulas/__init__.py",
            "sha256": "9057287e8115fadd6886e030f535cf50b2cb4fe19cdac9b9b3619424fb67eaf2",
            "tlsh": "c0e0c0a72c217137ff0989684f1167565da63d33140a6070349ce0733f415108d300ca"
        }
    ],
    "package_integrity": [
        {
            "filename": "goodoltoulas-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "47884f0279b1d41f0a75db7f9ba4d7d8ed6594a8dc99a89622f5e16a1514af14",
                "md5": "2429c6426cf2a0d433a75a4a43cf3a84",
                "sha256": "65008e17bddbd159ac4eda117d57ed9c43e043b0b7ddf02b8689da5f317b28f3"
            }
        },
        {
            "filename": "goodoltoulas-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "586b62d969803ee06cb19040afb474334050b44312c94559092a77788d402c81",
                "md5": "5785a39f923578e1bc28c6505017f41d",
                "sha256": "61b77b654cede432d7bb4d1bdf7b8ecac07e9244c4a4090aa478704e74514a99"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/goodoltoulas/MAL-2026-5272.json"