MAL-2026-1224 Malicious code in spark-ml-utilities (PyPI)
- Package
- spark-ml-utilities
- Registry
- PyPI
What is MAL-2026-1224?
MAL-2026-1224 is a malicious package in spark-ml-utilities, published on 3 Mar 2026.
Official description
During installation, the package starts obfuscated code that downloads and runs remote executables in specific environments. In some packages in the campaign, the code only attempts to exfiltrate some basic information using DNS requests and then likely cover tracks by installing a similarly named package from private repository
Related campaigns: 2026-02-spark-audit-notify, 2026-03-geekennedy
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-02-urllib-slim
Reasons (based on the campaign):
typosquatting
Downloads and executes a remote executable.
obfuscation
dependency-confusion
What should I do about MAL-2026-1224?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.