MAL-2026-625

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hangimani/MAL-2026-625.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2026-625

Published

2026-02-02T00:02:05Z

Modified

2026-02-23T02:54:42.579363Z

Summary

Malicious code in hangimani (PyPI)

Details

-= Per source details. Do not edit below this line.=-

Source: kam193 (4eb1b67eac28a42f372ecaaca274a28d15972e3cc8e063492f977364538e6c41)

During importing the module, package downloads a second-stage code from GitHub, which then runs an infostealer. After that, the downloaded code is removed

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-02-old-hangman

Reasons (based on the campaign):

Downloads and executes a remote malicious script.
infostealer
covering-tracks

Database specific

{
    "iocs": {
        "urls": [
            "https://codeload.github.com/Samantha0709/HangMan",
            "https://pastebin.com/raw/61NdZQax"
        ]
    },
    "malicious-packages-origins": [
        {
            "id": "pypi/2026-02-old-hangman/hangimani",
            "import_time": "2026-02-02T00:34:49.33936935Z",
            "sha256": "4eb1b67eac28a42f372ecaaca274a28d15972e3cc8e063492f977364538e6c41",
            "source": "kam193",
            "modified_time": "2026-02-02T00:02:05.729063Z",
            "versions": [
                "1.0.0"
            ]
        },
        {
            "id": "pypi/2026-02-old-hangman/hangimani",
            "import_time": "2026-02-04T17:48:33.701198809Z",
            "sha256": "d0bfb239431bc716583843c5ca362ba4df71ff1beaed771ec95e3dcad22753a2",
            "source": "kam193",
            "modified_time": "2026-02-02T00:02:05.729063Z",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}

References

Credits

- Kamil Mańkowski (kam193) - REPORTER
- - https://github.com/kam193
  - https://bad-packages.kam193.eu/

Affected packages

PyPI / hangimani

Package

Name: hangimani; View open source insights on deps.dev
Purl: pkg:pypi/hangimani

Affected ranges

Affected versions

1.*

1.0.0

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hangimani/MAL-2026-625.json"