dictmerge-lite@1.0.0
Vulnerability report · Last retrieved from osv.dev October 26, 2026 at 3:43 AM UTC
OSV ID
MAL-2026-18301
Ecosystem
pypi
Summary
During installation or import, the package executes infostealer code and exfiltrates cryptocurrency wallet, browsers' data, SSH keys and development credential files. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-dictmerge-lite Reasons (based on the campaign): - infostealer - exfiltration-crypto - exfiltration-browser-data - The package overrides the install command in setup.py to execute malicious code during installation. - exfiltration-ssh-keys - exfiltration-credentials
Source: kam193 (86ffa17e6ebc93b9c0509a6f6ec0f11a17bc79eec75d4fecf0f0b9520c3b93c5)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.