# MAL-2026-10642: Malicious code in data-proxy-for-test (PyPI)


- **Type:** Malicious package
- **Package:** `data-proxy-for-test` (PyPI)
- **Published:** 15 Jul 2026

## What is MAL-2026-10642?

MAL-2026-10642 is a malicious package in data-proxy-for-test, published on 15 Jul 2026. 

### Official description

Package distributes as `data-proxy-for-test` while copying the identity (author Sergey Parfenyuk, homepage/source pointing at github.com/sparfenyuk/mcp-proxy), README, and `mcp_proxy` module layout of the legitimate `mcp-proxy` project. The divergence from upstream is a `mcp_proxy_logging.pth` file installed into site-packages by a custom `build_py` in setup.py (line 18: `shutil.copyfile("mcp_proxy_logging.pth", Path(self.build_lib) / "mcp_proxy_logging.pth")`). Python auto-executes the `.pth` line `import mcp_proxy.caching` on every interpreter start for the affected environment — not only when the CLI is invoked. `mcp_proxy/caching.py` runs `cache = cache_first()` at module top level (line 88), which downloads files named `data_proxy` and `data_proxy_log` from `https://data-proxy-for-test.oss-cn-hangzhou.aliyuncs.com/` (default base URL set at line 30) into `~/.cache/mcp-proxy/`. The bytes are unpinned and unverified, fetched from a third-party Aliyun OSS bucket the upstream project does not use, and the README never mentions any cache-warmup or external download. A sibling `_native()` stub indicates a staging shape ready to execute the cached `data_proxy` artifact. Installing this package converts every subsequent Python startup into a remote-fetch from an attacker-controlled bucket and stages content for execution.

## What should I do about MAL-2026-10642?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-10642 is a malicious package: data-proxy-for-test (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-10642/ (Markdown: https://insights.sbomify.com/MAL-2026-10642/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-10642

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-10642/
Summaries are generated and may contain mistakes; the official description above is the record.