journey-test-hellospy@0.1.1
Vulnerability report · Last retrieved from osv.dev October 22, 2026 at 1:29 AM UTC
OSV ID
MAL-2026-18133
Ecosystem
pypi
Summary
During installation, package exfiltrates potentially sensitive environmental variables --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-10-journey-test-helloshell Reasons (based on the campaign): - The package contains code to create a reverse shell, allowing an attacker to execute any commands on the victim's machine. - The package overrides the install command in setup.py to execute malicious code during installation. - targetted-attack
Source: kam193 (418fea1fe789e9a44c77c08c9135b3da66b773882c9fb2757094c3f55b04321b)
Protect your entire dependency tree
Scan your lock files automatically on every PR. Block malicious packages before they reach production.