{"id":"MAL-2026-18343","aliases":[],"title":"Malicious code in numprint (PyPI)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (ca6ff316077349c92e2d1e5d7c3683a16e6542b952d5c7fc8743efa5d4c80243)\nDuring installation the package starts a background process executing commands provided by the attacker. The C2 communication happens through a GitHub Gist.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-numprint\n\n\nReasons (based on the campaign):\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n\n\n - rat\n","severity":"unknown","score":null,"published":"2026-10-27T16:48:48.000Z","modified":"2026-10-27T17:30:37.252Z","withdrawn":false,"knownExploited":false,"affected":[{"ecosystem":"PyPI","name":"numprint","ranges":[],"versions":["1.2.0"],"fixed":[]}],"references":["https://bad-packages.kam193.eu/pypi/package/numprint"],"sources":[{"name":"OSV","id":"MAL-2026-18343","modified":"2026-10-27T17:30:37.252425671Z","url":"https://osv.dev/vulnerability/MAL-2026-18343"}],"assessments":[]}