{"id":"MAL-2026-17847","summary":"Malicious code in npp-ml (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (7f575d02caf2363703b49c45c7f5ba106b798ee4f5b02f1977b118f2b52ff30e)\nThe package claims to provide a Notepad++ distribution, but in fact delivers ADExplorer, an Active Directory analysis tool.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-10-npp-ml\n\n\nReasons (based on the campaign):\n\n\n - other\n\n\n - impersonation\n","modified":"2026-10-13T15:00:03.786485622Z","published":"2026-10-12T20:17:47Z","database_specific":{"malicious-packages-origins":[{"sha256":"7f575d02caf2363703b49c45c7f5ba106b798ee4f5b02f1977b118f2b52ff30e","source":"kam193","versions":["0.1.7","0.1.8","0.1.9"],"id":"pypi/2026-10-npp-ml/npp-ml","import_time":"2026-10-12T20:46:18.126118521Z","modified_time":"2026-10-12T20:17:47.14413Z"},{"versions":["0.1.7","0.1.8","0.1.9","0.1.10"],"id":"pypi/2026-10-npp-ml/npp-ml","import_time":"2026-10-13T14:49:00.641384602Z","modified_time":"2026-10-13T14:38:04.044181Z","sha256":"14fea11838b844155e70cb38accede0c1bf97ebcf3e85a29ea6588f252e10ce0","source":"kam193"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/npp-ml"}],"affected":[{"package":{"name":"npp-ml","ecosystem":"PyPI","purl":"pkg:pypi/npp-ml"},"versions":["0.1.7","0.1.8","0.1.9","0.1.10"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/npp-ml/MAL-2026-17847.json"}}],"schema_version":"1.9.0","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}