{"id":"MAL-2026-19051","summary":"Malicious code in shanks (PyPI)","details":"The module shanks/shanks.py, when imported, looks up the machine's public IP address and location from a geolocation service and posts the IP address, city, state, postal code, latitude and longitude, with an @everyone mention, to a hard-coded Discord webhook. The package describes itself only as \"A small example pkg\". Version examined: 0.0.4; sdist SHA-256 dc417305d4b083a60ffda7aa310952306258fc12afc536a0641fc4a79c95bed8.","modified":"2026-11-09T23:15:34.631775449Z","published":"2026-11-07T03:16:10Z","affected":[{"package":{"name":"shanks","ecosystem":"PyPI","purl":"pkg:pypi/shanks"},"versions":["0.0.4"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/shanks/MAL-2026-19051.json"}}],"schema_version":"1.9.2","credits":[{"name":"Cordon Security, Inc.","contact":["https://cordonscan.com","https://github.com/Threx-code/cordon"],"type":"FINDER"},{"name":"Oluwatosin Amokeodo","contact":["mailto:oluwatosin.amokeodo@gmail.com","https://www.linkedin.com/in/oluwatosin-amokeodo/"],"type":"FINDER"}]}