MAL-2026-5797

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/neurodrift/MAL-2026-5797.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-5797

Published

2026-06-15T16:23:21Z

Modified

2026-06-17T10:00:59Z

Summary

Malicious code in neurodrift (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (1b632fa784b6125daaba0e4a2b9e775bc4fec21c7d41127b887f9dfe6e873ce0)

During installation, the code attempts to download and start a malicious executable.

Likely related to 2025-08-raknet-testing-package.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-easyaillm

Reasons (based on the campaign):

Downloads and executes a remote executable.
obfuscation
malware
tool:mshta

Database specific

{
    "iocs": {
        "domains": [
            "fixars.top"
        ],
        "urls": [
            "https://pastebin.com/raw/hEF5HaFc",
            "https://pastebin.com/raw/yBcUM1QBs",
            "https://pastebin.com/raw/yBcUM1QB",
            "http://fixars.top"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-06-easyaillm/neurodrift",
            "import_time": "2026-06-15T17:22:55.264138613Z",
            "modified_time": "2026-06-15T16:26:48.700534Z",
            "sha256": "8ac6b3dafe24c6df163af1e917f75bb49a8b2ae1ecb1baa4f7914922c8d5ad83",
            "source": "kam193",
            "versions": [
                "1.21"
            ]
        },
        {
            "id": "pypi/2026-06-easyaillm/neurodrift",
            "import_time": "2026-06-15T22:45:32.264740721Z",
            "modified_time": "2026-06-15T16:26:48.700534Z",
            "sha256": "4bbebf2d437cf04868e7e78e34fd21cc658acdd55614cc902e1d577f2a335ae6",
            "source": "kam193",
            "versions": [
                "1.21"
            ]
        },
        {
            "id": "pypi/2026-06-easyaillm/neurodrift",
            "import_time": "2026-06-16T10:17:17.179014652Z",
            "modified_time": "2026-06-15T16:26:48.700534Z",
            "sha256": "49b90734cf162bc3013cf1325a8b118994751cc9bf0f6fa159d7fcf0d54c4189",
            "source": "kam193",
            "versions": [
                "1.21"
            ]
        },
        {
            "id": "pypi/2026-06-easyaillm/neurodrift",
            "import_time": "2026-06-17T09:49:36.17588281Z",
            "modified_time": "2026-06-15T16:26:48.700534Z",
            "sha256": "1b632fa784b6125daaba0e4a2b9e775bc4fec21c7d41127b887f9dfe6e873ce0",
            "source": "kam193",
            "versions": [
                "1.21"
            ]
        }
    ]
}

References

Credits

- Kamil Mańkowski (kam193) - REPORTER
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / neurodrift

Package

Name: neurodrift; View open source insights on deps.dev
Purl: pkg:pypi/neurodrift

Affected ranges

Affected versions

1.*

1.21

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/neurodrift/MAL-2026-5797.json"