{"id":"MAL-2026-18402","title":"Malicious code in test-01-rafamarrara-learning-dc (PyPI)","summary":"Malicious code in test-01-rafamarrara-learning-dc (PyPI)","severity":"critical","exploited":true,"vendor":"test-01-rafamarrara-learning-dc","product":"test-01-rafamarrara-learning-dc","ecosystem":"pip","affected":["test-01-rafamarrara-learning-dc"],"published":"2026-10-29","updated":"2026-10-30","sourceUpdated":"2026-10-30T12:45:13.382644887Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/MAL-2026-18402","references":[{"url":"https://bad-packages.kam193.eu/pypi/package/test-01-rafamarrara-learning-dc"},{"url":"https://pypi.org/project/test-01-rafamarrara-learning-dc/1.0.0/"}],"tags":["osv","pip","malware"],"ingestedAt":"2026-10-30T19:05:36.396Z","slug":"MAL-2026-18402","body":"## Overview\n\n\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (45afe749f07493f7ac02d61769393cb172f6eb98caf40462892f6dbc3c489612)\nPackage appears to be a learning/test artifact with no observable malicious behavior. No install-time or import-time network I/O, no credential or secret reads, no subprocess execution of fetched content, and no lifecycle hooks that would harm the installer.\n\n## Source: kam193 (c9be43a3b810f36aa360f4654e412805d5e5362b462836b38a161c99b6d07816)\nPackage offers a middleware adding allegedly diagnostic endpoint to a web app. Besides allowing for env variable exfiltration, it also contains a hidden functionality allowing executing sent commands.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-test-01-rafamarrara-learning-dc\n\n\nReasons (based on the campaign):\n\n\n - backdoor\n\n\n - exfiltration-env-variables\n\n\n## Affected packages\n\n- `test-01-rafamarrara-learning-dc`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"abyssal","depthScore":70,"depthScoreParts":{"impact":52.3,"likelihood":0,"exploitation":18,"ransomware":0},"changes":[]}