{"id":"MAL-2026-443","summary":"Malicious code in 1q847 (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: kam193 (fe398aee3ca61989d1610e4b2edae183ef70d5fabc08709875ca9ef8725d82c5)\nPackage contains two DLL libraries, one of them packed. Both are widely recognized as malware. The exact behavior is not known\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-01-old-1q847\n\n\nReasons (based on the campaign):\n\n\n - malware\n\n\n - obfuscation\n","modified":"2026-01-21T19:04:41.627471Z","published":"2026-01-21T18:25:06Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-01-21T18:48:00.211506041Z","modified_time":"2026-01-21T18:25:06.913161Z","sha256":"fe398aee3ca61989d1610e4b2edae183ef70d5fabc08709875ca9ef8725d82c5","source":"kam193","versions":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.1.0","0.1.1","0.2.0","0.3.0","0.4.0","0.5.0","0.6.0","0.7.0","1.0.0","1.1.0","1.1.1","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8"],"id":"pypi/2026-01-old-1q847/1q847"}]},"references":[{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/87d4efd371edf4ccca805a15ddc4f5c4f89e0d7d46008d51d1055a01e78360e8/detection"},{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/94b82dacf24a8186311b46400cdd11df4ddab9408099806106213a96d2de2621/behavior"},{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/2a37ce301490bd4b7c5d02b768b054705fe4620db6ef81061718c1fe89c9f27e/detection"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/1q847"}],"affected":[{"package":{"name":"1q847","ecosystem":"PyPI","purl":"pkg:pypi/1q847"},"versions":["0.0.1","0.0.2","0.0.3","0.0.4","0.0.5","0.0.6","0.0.7","0.1.0","0.1.1","0.2.0","0.3.0","0.4.0","0.5.0","0.6.0","0.7.0","1.0.0","1.1.0","1.1.1","1.1.3","1.1.4","1.1.5","1.1.6","1.1.7","1.1.8"],"database_specific":{"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/1q847/MAL-2026-443.json"}}],"schema_version":"1.7.3","credits":[{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}