{"id":"MAL-2026-14488","summary":"Malicious code in python-walletlibr-v (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (6783cffec9c8f9377babacd1cb4490a278bace564b34861bf49b35258be7220c)\npython-walletlibr-v is a wallet-lookalike PyPI package that ships no wallet functionality — only a stub hello() that prints 'Hello from my custom library!' and placeholder author metadata (__author__ = 'Your Name'). Its setup.py registers a CustomInstall command that, on Windows at pip install time, writes a.bat file into %TEMP%, spawns a new cmd.exe console to execute it via subprocess.Popen(['cmd.exe','/k', bat_path], CREATE_NEW_CONSOLE), and calls os.system('calc'). Arbitrary local command execution fires automatically during pip install on Windows hosts, unrelated to any advertised functionality.\n","modified":"2026-08-25T23:51:34.131880186Z","published":"2026-08-25T08:34:01Z","database_specific":{"malicious-packages-origins":[{"source":"amazon-inspector","versions":["0.7.9"],"id":"IN-MAL-2026-018733","import_time":"2026-08-25T08:49:18.077188637Z","modified_time":"2026-08-25T08:34:01Z","sha256":"6783cffec9c8f9377babacd1cb4490a278bace564b34861bf49b35258be7220c"}]},"references":[{"type":"PACKAGE","url":"https://pypi.org/project/python-walletlibr-v/0.7.9/"}],"affected":[{"package":{"name":"python-walletlibr-v","ecosystem":"PyPI","purl":"pkg:pypi/python-walletlibr-v"},"versions":["0.7.9"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"evidence_files":[{"path":"setup.py","sha256":"d0b7ed3487fb76de391846693737f7cd9b1a385d967854c5ca111ea2c06f5126","tlsh":"6f2120028977097516b1036b0916cc06ffaea4a35775b28636fc4e349fba021060e93f"},{"path":"pycryptoshuffle/__init__.py","sha256":"a9eed37934c714a36a35e6adea50014e0fad2d323d1628b1d8e4a92bbaa2c134","tlsh":"25c09b450657155191dcc47f5500691179fd40b03fd55015573c311e79571555de524c"}],"package_integrity":[{"filename":"python_walletlibr_v-0.7.9.tar.gz","hashes":{"blake2b_256":"caf2051e75361d70d22f00732f27905e1223cb70ba0be6c6f831f8f191384905","md5":"16935464ca0bc132b702dccd08a04b5a","sha256":"7450765e50d74a4aed668e4159b58fa1b82a5d709bb6376fec84ed4776ecc6a5"}}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/python-walletlibr-v/MAL-2026-14488.json"}}],"schema_version":"1.9.0","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"}]}