Malicious code in numprint (PyPI)
The advisory, in context
-= Per source details. Do not edit below this line.=-
Source: kam193 (ca6ff316077349c92e2d1e5d7c3683a16e6542b952d5c7fc8743efa5d4c80243)
During installation the package starts a background process executing commands provided by the attacker. The C2 communication happens through a GitHub Gist.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-numprint
Reasons (based on the campaign):
-
The package overrides the install command in setup.py to execute malicious code during installation.
-
The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
-
rat
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
1 explicitly affected versions
1.2.0
View affected-version evidence
{
"ranges": [],
"versions": [
"1.2.0"
]
}