---
id: MAL-2026-18343
title: Malicious code in numprint (PyPI)
summary: Malicious code in numprint (PyPI)
severity: critical
exploited: true
vendor: numprint
product: numprint
ecosystem: pip
affected:
  - numprint
published: '2026-10-27'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T13:48:11.568956908Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/MAL-2026-18343'
references:
  - url: 'https://bad-packages.kam193.eu/pypi/package/numprint'
  - url: 'https://pypi.org/project/numprint/1.2.0/'
tags:
  - osv
  - pip
  - malware
ingestedAt: '2026-10-27T18:15:34.028Z'
---

## Overview


---
_-= Per source details. Do not edit below this line.=-_

## Source: amazon-inspector (b2767ab63222f7b2b6c76334822fb6e8c8b0385df53833206362fcf52f93392a)
numprint 1.2.0 on PyPI could not be fully characterized from the available signals. No specific installer-harm fingerprint (hardcoded C2, credential path read, home-directory secret scan, install-time fetch-and-execute, dropper, backdoor, self-propagation) is concretely identified in this record. The package name resembles common numeric/printing utility names but no benign purpose is confirmed either.

## Source: kam193 (ca6ff316077349c92e2d1e5d7c3683a16e6542b952d5c7fc8743efa5d4c80243)
During installation the package starts a background process executing commands provided by the attacker. The C2 communication happens through a GitHub Gist.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-10-numprint


Reasons (based on the campaign):


 - The package overrides the install command in setup.py to execute malicious code during installation.


 - The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.


 - rat


## Affected packages

- `numprint`

## Remediation

Refer to the advisory for the patched release.