MAL-2026-6248

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/jsonschema-viewer/MAL-2026-6248.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6248
Published
2026-06-21T13:38:16Z
Modified
2026-06-23T19:46:24Z
Summary
Malicious code in jsonschema-viewer (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (3692022b4caf5ac51d868aaae58e793520ac3bd36703841eb615942baf85bb87)

The package's only function — main() in src/jsonschema_viewer/main.py, registered as the jsonschema-viewer console script — invokes os.system to fetch a shell script from http://49.232.169.67:8084/slt via curl or wget and pipes the response into sh. The fetch uses plaintext HTTP to a bare IP with no pinning, no hash verification, and an opaque payload, and bears no relationship to the package's advertised purpose ('A minimal jsonschema-viewer package'). Author metadata is the placeholder 'Your Name' with no email/URL and the README is a single empty sentence, consistent with a throwaway dropper package. Any developer who installs this package and runs the documented CLI executes arbitrary attacker-controlled code on their machine.

Source: kam193 (76cad60a803b91e4da8eb438787ca5f044fd3deafedef5de1fdb4e92bd8fd9e1)

Package configures an entry point (command line) that executes a remote script. It then downloads a next stage malware, which acts as next dropper for a fileless malware.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-jsonschema-viewer

Reasons (based on the campaign):

  • malware

  • Downloads and executes a remote executable.

  • Downloads and executes a remote malicious script.

Database specific 
{
    "iocs": {
        "ips": [
            "49.232.169.67"
        ],
        "urls": [
            "http://49.232.169.67:8084/slt"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-06-jsonschema-viewer/jsonschema-viewer",
            "import_time": "2026-06-21T14:51:07.787750138Z",
            "modified_time": "2026-06-21T13:38:16.706256Z",
            "sha256": "76cad60a803b91e4da8eb438787ca5f044fd3deafedef5de1fdb4e92bd8fd9e1",
            "source": "kam193",
            "versions": [
                "0.1.0"
            ]
        },
        {
            "id": "IN-MAL-2026-007336",
            "import_time": "2026-06-23T19:40:40.77649074Z",
            "modified_time": "2026-06-23T19:20:00Z",
            "sha256": "3692022b4caf5ac51d868aaae58e793520ac3bd36703841eb615942baf85bb87",
            "source": "amazon-inspector",
            "versions": [
                "0.1.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / jsonschema-viewer

Package

Name
jsonschema-viewer
View open source insights on deps.dev
Purl
pkg:pypi/jsonschema-viewer

Affected ranges

Affected versions

0.*
0.1.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "src/jsonschema_viewer/main.py",
            "sha256": "ab8d2fd4e6602cc6451343cb19142242fc72bfdd7d84cfe7d7bcf871abea455e",
            "tlsh": "a7c022a9828431606ec2c5ac2a604089526b948ea2e0517ce64004c64f16402beabc9b"
        },
        {
            "path": "pyproject.toml",
            "sha256": "8a19a55348a22636653c2e8bf03a8b1c997eb87097bbe10d4189cb57a3d282e7",
            "tlsh": "dce068728712fd209d9f318878946100fcf2ad0087e0c414b2cac0c8554a9c9d7e993d"
        }
    ],
    "package_integrity": [
        {
            "filename": "jsonschema_viewer-0.1.0-py3-none-any.whl",
            "hashes": {
                "blake2b_256": "10e8e6ae803aa913689ef108fe2ce1c31bdc89815a4016e69bcbcb18ce2f4d65",
                "md5": "13684b2cbd4e00d8b32fcbb41f823cdc",
                "sha256": "c136d40344e00c6909bc91787bf4013595d86207e94a2a1e2d8367e78f1ca9d7"
            }
        },
        {
            "filename": "jsonschema_viewer-0.1.0.tar.gz",
            "hashes": {
                "blake2b_256": "1dd4e822830c768acaeada8e81b7397d0c629fcc45f2a00b2040a8034e9362b9",
                "md5": "5649e50cb018756f0c39ed6bfec86120",
                "sha256": "1784b59ca95420abf9d08cb536ae867c8c643286fb2c6c2139380e235f18801f"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/jsonschema-viewer/MAL-2026-6248.json"