{"answers":{"affected":"1 open source package ship an affected version, including playwrightr.","exploited":"There is no known exploitation of MAL-2026-10020 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-10020 is a malicious package in playwrightr, published on 9 Jul 2026."},"fix_prompt":"MAL-2026-10020 is a malicious package: playwrightr (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-10020/ (Markdown: https://insights.sbomify.com/MAL-2026-10020/index.md)","id":"MAL-2026-10020","markdown":"https://insights.sbomify.com/MAL-2026-10020/index.md","name":"MAL-2026-10020","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"setup.py registers a CustomInstallCommand that runs automatically on `pip install` under Windows. It uses WinHTTP via ctypes to fetch a binary from florinn.dev:65534/ins.exe, writes it to %TEMP%\\runner.exe, deletes the NTFS Zone.Identifier alternate data stream to bypass Mark-of-the-Web / SmartScreen warnings, and launches the executable hidden via CreateProcessW with CREATE_NO_WINDOW. The package name is a one-character edit of the widely used 'playwright' PyPI package, and its only shipped functionality is an unrelated `change_theme()` stub referencing pyqt6darktheme, confirming the package exists solely to deliver the dropper. Installer harm: on `pip install playwrightr` on Windows, an attacker-controlled executable runs on the installer's machine with the installing user's privileges and with anti-detection measures actively engaged.\n\nPackage downloads and runs a remote executable, which was found to downloads further exes and starting coine mining\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\nCampaign: 2026-07-pyqt6darktheme\n\nReasons (based on the campaign):\n\n - cryptominer\n\n - Downloads and executes a remote executable.\n\n - malware\n\n - The package overrides the install command in setup.py to execute malicious code during installation.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in playwrightr (PyPI)","id":"MAL-2026-10020","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"playwrightr","purl":"pkg:pypi/playwrightr","source":"MAL-2026-10020"}],"products":null,"published":"2026-07-09","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-10020/"}