MAL-2026-10973 Malicious code in fluffy-octo-broccoli (PyPI)

fluffy-octo-broccoli ships a 10.7 MB qiwi.zip archive whose contents yield no readable filenames or strings via extraction, alongside a run.sh that unzips the archive in the current working directory, chmods start.sh executable, and runs it. The package's console-script entry (launcher.py) invokes bash run.sh via subprocess. The README's only stated purpose is 'Runs the bundled startup script when installed,' with no description of what the executed shell payload actually does. The archive's opacity prevents any inspection of the code that will run when the CLI is invoked. Execution is not automatic on pip install — the user must invoke the console script — but once invoked, the executed shell content is completely undocumented and unverifiable.

In this campaign, packages use names similar to popular services (e.g. Kimi AI) to deploy cryptominer.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-07-kimichat

Reasons (based on the campaign):

• cryptominer