{"id":"MAL-2026-18343","title":"Malicious code in numprint (PyPI)","summary":"Malicious code in numprint (PyPI)","severity":"critical","exploited":true,"vendor":"numprint","product":"numprint","ecosystem":"pip","affected":["numprint"],"published":"2026-10-27","updated":"2026-10-29","sourceUpdated":"2026-10-29T13:48:11.568956908Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18343","references":[{"url":"https://bad-packages.kam193.eu/pypi/package/numprint"},{"url":"https://pypi.org/project/numprint/1.2.0/"}],"tags":["osv","pip","malware"],"ingestedAt":"2026-10-27T18:15:34.028Z","slug":"MAL-2026-18343","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (b2767ab63222f7b2b6c76334822fb6e8c8b0385df53833206362fcf52f93392a)\nnumprint 1.2.0 on PyPI could not be fully characterized from the available signals. No specific installer-harm fingerprint (hardcoded C2, credential path read, home-directory secret scan, install-time fetch-and-execute, dropper, backdoor, self-propagation) is concretely identified in this record. The package name resembles common numeric/printing utility names but no benign purpose is confirmed either.\n\n## Source: kam193 (ca6ff316077349c92e2d1e5d7c3683a16e6542b952d5c7fc8743efa5d4c80243)\nDuring installation the package starts a background process executing commands provided by the attacker. The C2 communication happens through a GitHub Gist.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-numprint\n\n\nReasons (based on the campaign):\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n\n - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.\n\n\n - rat\n\n\n## Affected packages\n\n- `numprint`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[]}