{"answers":{"affected":"1 open source package ship an affected version, including xayoub-xctxteam.","exploited":"There is no known exploitation of MAL-2026-13426 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-13426 is a malicious package in xayoub-xctxteam, published on 6 Aug 2026."},"fix_prompt":"MAL-2026-13426 is a malicious package: xayoub-xctxteam (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-13426/ (Markdown: https://insights.sbomify.com/MAL-2026-13426/index.md)","id":"MAL-2026-13426","markdown":"https://insights.sbomify.com/MAL-2026-13426/index.md","name":"MAL-2026-13426","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On `import xAyOuB_XcTxTeaM`, __init__.py automatically starts a Flask HTTP server bound to 0.0.0.0:50019 exposing `/spam?uid=`, `/stop`, and `/status` endpoints. Any remote party able to reach the installer's host on that port can supply an arbitrary uid and cause the package to drive outbound abuse traffic from the installer's IP. In parallel, import-time background threads log in ~20 hardcoded Garena Free Fire guest accounts (shipped as accounts.json in the sdist) against loginbp.ggpolarbear.com and 100067.connect.garena.com using a hardcoded OAuth client_id=100067 and client_secret, open game rooms, and emit `openroom`/`spmroom`/`SEnd_InV` invite-spam packets to the remote-supplied target. TLS verification is disabled for the game-service HTTPS calls (`verify=False`, `ssl._create_unverified_context()`, `urllib3.disable_warnings`). The package additionally ships 20 uid:password pairs and a Garena OAuth client secret in cleartext. Installing/importing this package exposes an unauthenticated remote-control interface on the installer's host and uses the installer's IP as an abuse source against a third-party service.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in xayoub-xctxteam (PyPI)","id":"MAL-2026-13426","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"xayoub-xctxteam","purl":"pkg:pypi/xayoub-xctxteam","source":"MAL-2026-13426"}],"products":null,"published":"2026-08-06","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-13426/"}