grokwrapper @0.2.0
Vulnerability report · Last retrieved from osv.dev August 14, 2026 at 9:32 AM UTC
OSV ID
MAL-2026-811
Ecosystem
pypi
Summary
During importing the module, package silently execute code hidden in an embedded config file, and downloads remote executable. It's then added to Run registry key for persistence and started. During analysis, the executable was not detected by antiviruses. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-02-grokwrapper Reasons (based on the campaign): - Downloads and executes a remote executable. - obfuscation - peristence-autorun
Source: kam193 (a7ae896464be7f195243e35231a2435d0a1eb055cc7fa8cfaef707c7e11c55b2)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.