MAL-2026-6734

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/horde-python-client/MAL-2026-6734.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6734
Published
2026-07-02T21:23:53Z
Modified
2026-07-08T17:16:54.588677934Z
Summary
Malicious code in horde-python-client (PyPI)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f2ae9afcd7af22c82b137c1142ae643502d82f3d1f28712b2e5c7ec412bea85e)

horde-python-client 99999.0.0 is a dependency-confusion lure. On import horde_python_client, a daemon thread unconditionally POSTs a JSON payload containing the host's hostname, the USER/USERNAME environment variable, and the current working directory to http://109.123.247.172/pypi over plain HTTP. The destination is a bare IP unrelated to any legitimate package publisher. The package ships with placeholder metadata (description "Internal package", author "Security Research") and an absurdly high version number (99999.0.0) — the canonical shape for overriding a target organization's private package of the same name in resolver precedence. Installer harm: any developer or build system that resolves this package and imports it leaks host identifiers to the attacker, confirming a successful dependency-confusion hit and enabling follow-on targeting.

Source: kam193 (ad72fe1fdc56e7fb5716a906fb8481bfe1e477d2f97c649d5db853a79130628a)

Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: GENERIC-standard-pypi-install-pentest

Reasons (based on the campaign):

  • The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

  • The package overrides the install command in setup.py to execute malicious code during installation.

Database specific 
{
    "malicious-packages-origins": [
        {
            "import_time": "2026-07-02T21:29:02.667033146Z",
            "id": "pypi/GENERIC-standard-pypi-install-pentest/horde-python-client",
            "sha256": "ad72fe1fdc56e7fb5716a906fb8481bfe1e477d2f97c649d5db853a79130628a",
            "versions": [
                "99999.0.0"
            ],
            "source": "kam193",
            "modified_time": "2026-07-02T21:23:53.578472Z"
        },
        {
            "import_time": "2026-07-08T17:01:32.704709685Z",
            "id": "IN-MAL-2026-008127",
            "sha256": "f2ae9afcd7af22c82b137c1142ae643502d82f3d1f28712b2e5c7ec412bea85e",
            "modified_time": "2026-07-08T16:28:39Z",
            "source": "amazon-inspector",
            "versions": [
                "99999.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

PyPI / horde-python-client

Package

Name
horde-python-client
View open source insights on deps.dev
Purl
pkg:pypi/horde-python-client

Affected ranges

Affected versions

99999.*
99999.0.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "horde_python_client/__init__.py",
            "tlsh": "6e01acc6e8345882628b724888254a782237b4576f02b8b0bd4c9f7c0fdc46952786f8",
            "sha256": "2f180a296cc8490ee65619e18d1c62e85895ad4151ea927389c0e18f9364decf"
        },
        {
            "path": "setup.py",
            "tlsh": "65d097524e4292b058c0c99e48e138021a28aa373e20b0e8f38003803f8e4db8f332a9",
            "sha256": "cadb4d65a9b7ec5edadb1a7352b50f09b3ef3a32115b72f8bc7252d69a72a3a6"
        }
    ],
    "package_integrity": [
        {
            "filename": "horde_python_client-99999.0.0.tar.gz",
            "hashes": {
                "sha256": "c64fc3df904e530585083fd1d0ae3fef410b515b0335d10c1885cd0e75576990",
                "blake2b_256": "589c2b73bf17cc40ca0d837bbc6c8feeace5f61931e479bd673812cfd6732c01",
                "md5": "a6f2c3b63758f3301b161bc75e71e02c"
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/horde-python-client/MAL-2026-6734.json"