OSV ID
MAL-2026-15933
Ecosystem
pypi
Summary
During import, package loads code disguised as ".wav" file. It performs extensive fingerprinting against sandboxes, and finally downloads and executes heavily obfuscated code. The remote code tries once more to avoid sandbox execution, establishes persistence via scheduled tasks and executes shellcode. Malicious code targets only Windows. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-houdus Reasons (based on the campaign): - obfuscation - Downloads and executes a remote malicious script. - The package contains code to detect if it is running in a sandbox environment. - persistence - shellcode
Source: kam193 (94c533504ec9815f9ba159827d0c7516c779d03d31fc3ac897317fdbc14c2805)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.