{"id":"MAL-2026-6248","summary":"Malicious code in jsonschema-viewer (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (3692022b4caf5ac51d868aaae58e793520ac3bd36703841eb615942baf85bb87)\nThe package's only function — main() in src/jsonschema_viewer/main.py, registered as the `jsonschema-viewer` console script — invokes os.system to fetch a shell script from http://49.232.169.67:8084/slt via curl or wget and pipes the response into `sh`. The fetch uses plaintext HTTP to a bare IP with no pinning, no hash verification, and an opaque payload, and bears no relationship to the package's advertised purpose ('A minimal jsonschema-viewer package'). Author metadata is the placeholder 'Your Name' with no email/URL and the README is a single empty sentence, consistent with a throwaway dropper package. Any developer who installs this package and runs the documented CLI executes arbitrary attacker-controlled code on their machine.\n\n## Source: kam193 (76cad60a803b91e4da8eb438787ca5f044fd3deafedef5de1fdb4e92bd8fd9e1)\nPackage configures an entry point (command line) that executes a remote script. It then downloads a next stage malware, which acts as next dropper for a fileless malware.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-06-jsonschema-viewer\n\n\nReasons (based on the campaign):\n\n\n - malware\n\n\n - Downloads and executes a remote executable.\n\n\n - Downloads and executes a remote malicious script.\n","modified":"2026-06-23T19:46:24.465452173Z","published":"2026-06-21T13:38:16Z","database_specific":{"iocs":{"ips":["49.232.169.67"],"urls":["http://49.232.169.67:8084/slt"]},"malicious-packages-origins":[{"sha256":"76cad60a803b91e4da8eb438787ca5f044fd3deafedef5de1fdb4e92bd8fd9e1","import_time":"2026-06-21T14:51:07.787750138Z","id":"pypi/2026-06-jsonschema-viewer/jsonschema-viewer","modified_time":"2026-06-21T13:38:16.706256Z","versions":["0.1.0"],"source":"kam193"},{"import_time":"2026-06-23T19:40:40.77649074Z","id":"IN-MAL-2026-007336","modified_time":"2026-06-23T19:20:00Z","versions":["0.1.0"],"source":"amazon-inspector","sha256":"3692022b4caf5ac51d868aaae58e793520ac3bd36703841eb615942baf85bb87"}]},"references":[{"type":"EVIDENCE","url":"https://www.virustotal.com/gui/file/bd77582bcc534db6a56f1471f8134296a5f39b90c7ec2761e14e7ccef4667ab4/detection"},{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/jsonschema-viewer"},{"type":"PACKAGE","url":"https://pypi.org/project/jsonschema-viewer/0.1.0/"}],"affected":[{"package":{"name":"jsonschema-viewer","ecosystem":"PyPI","purl":"pkg:pypi/jsonschema-viewer"},"versions":["0.1.0"],"database_specific":{"cwes":[{"name":"Embedded Malicious Code","cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature."}],"indicators":{"package_integrity":[{"hashes":{"blake2b_256":"10e8e6ae803aa913689ef108fe2ce1c31bdc89815a4016e69bcbcb18ce2f4d65","md5":"13684b2cbd4e00d8b32fcbb41f823cdc","sha256":"c136d40344e00c6909bc91787bf4013595d86207e94a2a1e2d8367e78f1ca9d7"},"filename":"jsonschema_viewer-0.1.0-py3-none-any.whl"},{"filename":"jsonschema_viewer-0.1.0.tar.gz","hashes":{"blake2b_256":"1dd4e822830c768acaeada8e81b7397d0c629fcc45f2a00b2040a8034e9362b9","md5":"5649e50cb018756f0c39ed6bfec86120","sha256":"1784b59ca95420abf9d08cb536ae867c8c643286fb2c6c2139380e235f18801f"}}],"evidence_files":[{"path":"src/jsonschema_viewer/main.py","sha256":"ab8d2fd4e6602cc6451343cb19142242fc72bfdd7d84cfe7d7bcf871abea455e","tlsh":"a7c022a9828431606ec2c5ac2a604089526b948ea2e0517ce64004c64f16402beabc9b"},{"path":"pyproject.toml","sha256":"8a19a55348a22636653c2e8bf03a8b1c997eb87097bbe10d4189cb57a3d282e7","tlsh":"dce068728712fd209d9f318878946100fcf2ad0087e0c414b2cac0c8554a9c9d7e993d"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/jsonschema-viewer/MAL-2026-6248.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"}]}