MAL-2026-6280

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ip-rotat/MAL-2026-6280.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6280
Published
2026-06-23T10:23:00Z
Modified
2026-06-24T08:01:23.092520723Z
Summary
Malicious code in ip-rotat (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (e85ab2724beee13bb6c2658c5bf5d50069c83619f062d39935226ff1fee1c0a3)

On pip install or pip download, setup.py registers overridden install and egg_info cmdclass entries that execute ps -elf to capture the host's process listing and iterate the entire os.environ mapping into a URL-encoded body, then POST the combined payload via curl to http://gjampdwmdjmppwedtkpbbdkq05f6iiz6r.oast.fun over plaintext HTTP. Bulk env scraping at install time leaks any CI/CD secrets present in the environment (AWS keys, GitHub/npm/PyPI tokens, etc.) along with a system-wide process listing. The package ships no actual ip-rotation functionality — setup.py contains only the exfiltration payload, the package name ip_rotat is a one-character truncation of common ip-rotator-style libraries, and the README references the this_is_fine_wuzzi install-time-code-execution PoC. The combination of name confusion, zero advertised functionality, and an automatic install-time exfil hook is a supply-chain attack against any installer.

Source: kam193 (a7a8225ea0ef3ae5d58eed407fa3e3af246d4e246125598ce5e6720fc4e47e5d)

During installation, the package exfiltrates env variables

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-ip-rotat

Reasons (based on the campaign):

  • The package overrides the install command in setup.py to execute malicious code during installation.

  • exfiltration-env-variables

  • typosquatting

Database specific 
{
    "iocs": {
        "domains": [
            "gjampdwmdjmppwedtkpbbdkq05f6iiz6r.oast.fun"
        ]
    },
    "malicious-packages-origins": [
        {
            "sha256": "3ecb8a355dcbe7df86e0a785d8639e85faab9a5b4bad430ae3701ffa9432a4d2",
            "import_time": "2026-06-23T10:43:06.710271168Z",
            "source": "kam193",
            "modified_time": "2026-06-23T10:23:00.519394Z",
            "versions": [
                "0.0.1"
            ],
            "id": "pypi/2026-06-ip-rotat/ip-rotat"
        },
        {
            "sha256": "c94ce837f78d13ec8e012833efb46fab8b496311d90347759f21366b3bfdfbea",
            "import_time": "2026-06-23T13:28:20.422406368Z",
            "source": "kam193",
            "modified_time": "2026-06-23T10:23:00.519394Z",
            "versions": [
                "0.0.1"
            ],
            "id": "pypi/2026-06-ip-rotat/ip-rotat"
        },
        {
            "sha256": "e85ab2724beee13bb6c2658c5bf5d50069c83619f062d39935226ff1fee1c0a3",
            "import_time": "2026-06-23T19:40:40.585497582Z",
            "source": "amazon-inspector",
            "modified_time": "2026-06-23T18:58:13Z",
            "versions": [
                "0.0.1"
            ],
            "id": "IN-MAL-2026-007335"
        },
        {
            "sha256": "a7a8225ea0ef3ae5d58eed407fa3e3af246d4e246125598ce5e6720fc4e47e5d",
            "import_time": "2026-06-24T07:47:34.502647077Z",
            "source": "kam193",
            "modified_time": "2026-06-23T10:23:00.519394Z",
            "versions": [
                "0.0.1"
            ],
            "id": "pypi/2026-06-ip-rotat/ip-rotat"
        }
    ]
}
References
Credits

Affected packages

PyPI / ip-rotat

Package

Name
ip-rotat
View open source insights on deps.dev
Purl
pkg:pypi/ip-rotat

Affected ranges

Affected versions

0.*
0.0.1

Database specific

source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/ip-rotat/MAL-2026-6280.json"
cwes 
[
    {
        "name": "Embedded Malicious Code",
        "description": "The product contains code that appears to be malicious in nature.",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "tlsh": "45316207e1bf29291ec344a0558f03959bc0e3a32f6471fa72fc29191f0b129103b8af",
            "sha256": "f412ddb8e55631ff8fdb669a2a93b79e9390eb3e402e5a5f632c27366087d599",
            "path": "setup.py"
        }
    ],
    "package_integrity": [
        {
            "filename": "ip_rotat-0.0.1-py3-none-any.whl",
            "hashes": {
                "sha256": "bd9523c4a1ba2db706215f8cff0be50f842d1fc34d536afea3710ec5c637dc99",
                "md5": "b06870b5cab24c259e195529018f64ee",
                "blake2b_256": "e3fe494297db1eca4e166d99346cb88890eb373248d08338204f96580259a020"
            }
        },
        {
            "filename": "ip_rotat-0.0.1.tar.gz",
            "hashes": {
                "sha256": "1ac023fc2f99194fb57b2bbba7a124b5d28b4acd89a71a65f3f7755ba3a0b9df",
                "md5": "4b0593b71ff32057e819e070ba3e7677",
                "blake2b_256": "fa85c74a78d44c718547ee47408a6a8d203f983722fad48518d0372789596482"
            }
        }
    ]
}