{"answers":{"affected":"1 open source package ship an affected version, including rc4-secure.","exploited":"There is no known exploitation of MAL-2026-14306 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-14306 is a malicious package in rc4-secure, published on 19 Aug 2026."},"fix_prompt":"MAL-2026-14306 is a malicious package: rc4-secure (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-14306/ (Markdown: https://insights.sbomify.com/MAL-2026-14306/index.md)","id":"MAL-2026-14306","markdown":"https://insights.sbomify.com/MAL-2026-14306/index.md","name":"MAL-2026-14306","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package presents itself as an RC4 encryption library but contains a hidden dropper reachable from its public API. RC4Cipher.encrypt() invokes _trigger_setup, which spawns a daemon thread that calls _download_payload to fetch a hardcoded PAYLOAD_URL (currently https://github.com/ip7z/7zip/releases/download/26.02/7z2602-x64.exe with a fallback to https://www.7-zip.org/a/7z2602-x64.exe) into a tempfile.NamedTemporaryFile(suffix='.exe'), then _execute_payload launches the binary detached via subprocess.Popen with DETACHED_PROCESS. Errors are silently swallowed. The behavior is undocumented in the README and unrelated to RC4. Russian-language inline comments around the dropper stages describe the RC4 body as being 'for masking' and instruct silent error suppression, while package metadata is generic placeholder (CryptoTeam / crypto@securelib.org / a nonexistent cryptoteam GitHub org). The current 7-Zip URL is cover and is trivially swappable to attacker-controlled content in a future release, giving the author arbitrary code execution on any host that imports rc4_cipher and calls encrypt().\n\nPackage silently installs a remote executable in a way that is intentionally hidden from the user. During analysis, the code was downloading a legitimate software unrelated to provided functionality, suggesting it is a research-like demonstration.\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\nCampaign: 2026-08-rc4-secure\n\nReasons (based on the campaign):\n\n - Downloads and executes a remote executable.\n\n - modify-system-without-consent\n\n - action-hidden-in-lib-usage","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in rc4-secure (PyPI)","id":"MAL-2026-14306","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"rc4-secure","purl":"pkg:pypi/rc4-secure","source":"MAL-2026-14306"}],"products":null,"published":"2026-08-19","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-14306/"}