{"id":"MAL-2026-19940","summary":"Malicious code in gateio-v4 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (e2dadc0ea6466fc6e39b8a34a47ac17eb603afea28c8c8c00308af9497c8324d)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n","modified":"2026-11-15T02:45:04.661884793Z","published":"2026-11-15T01:41:33Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-11-15T02:16:34.364750828Z","modified_time":"2026-11-15T01:47:15.902198Z","sha256":"e2dadc0ea6466fc6e39b8a34a47ac17eb603afea28c8c8c00308af9497c8324d","source":"kam193","versions":["99.99.1"],"id":"pypi/GENERIC-standard-pypi-install-pentest/gateio-v4"},{"source":"kam193","versions":["99.99.1"],"id":"pypi/GENERIC-questionable-pentest/gateio-v4","import_time":"2026-11-15T02:36:38.386414737Z","modified_time":"2026-11-15T02:00:56.535096Z","sha256":"acecc5214f539226ca3a78db76604a123277064f66ab03a5136cca859befc563"}]},"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/gateio-v4"}],"affected":[{"package":{"name":"gateio-v4","ecosystem":"PyPI","purl":"pkg:pypi/gateio-v4"},"versions":["99.99.1"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/gateio-v4/MAL-2026-19940.json"}}],"schema_version":"1.9.2","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}