MAL-2026-1263 Malicious code in python-module-installer (PyPI)
- Package
- python-module-installer
- Registry
- PyPI
What is MAL-2026-1263?
MAL-2026-1263 is a malicious package in python-module-installer, published on 6 Mar 2026.
Official description
The package clones a legitimate webdavclient3 library and modifies it to be an installer utility. During installation, the package exfiltrates the current working directory to a remote WebDAV server or Telegram Bot. Additionally, the package targets cryptocurrency operations in another suspicious project, https://github.com/fewcatltd/zkSync/
The install_modules() method injects code into two files, which are characteristic for this repository, and causes exfiltrating configuration files during cryptocurrency exchange operations.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-03-old-python-module-installer
Reasons (based on the campaign):
impersonation
dependency-confusion
files-exfiltration
action-hidden-in-lib-usage
clones-real-package
crypto-related
exfiltration-crypto
What should I do about MAL-2026-1263?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.