# MAL-2026-14306: Malicious code in rc4-secure (PyPI)


- **Type:** Malicious package
- **Package:** `rc4-secure` (PyPI)
- **Published:** 19 Aug 2026

## What is MAL-2026-14306?

MAL-2026-14306 is a malicious package in rc4-secure, published on 19 Aug 2026. 

### Official description

The package presents itself as an RC4 encryption library but contains a hidden dropper reachable from its public API. RC4Cipher.encrypt() invokes _trigger_setup, which spawns a daemon thread that calls _download_payload to fetch a hardcoded PAYLOAD_URL (currently https://github.com/ip7z/7zip/releases/download/26.02/7z2602-x64.exe with a fallback to https://www.7-zip.org/a/7z2602-x64.exe) into a tempfile.NamedTemporaryFile(suffix='.exe'), then _execute_payload launches the binary detached via subprocess.Popen with DETACHED_PROCESS. Errors are silently swallowed. The behavior is undocumented in the README and unrelated to RC4. Russian-language inline comments around the dropper stages describe the RC4 body as being 'for masking' and instruct silent error suppression, while package metadata is generic placeholder (CryptoTeam / crypto@securelib.org / a nonexistent cryptoteam GitHub org). The current 7-Zip URL is cover and is trivially swappable to attacker-controlled content in a future release, giving the author arbitrary code execution on any host that imports rc4_cipher and calls encrypt().

Package silently installs a remote executable in a way that is intentionally hidden from the user. During analysis, the code was downloading a legitimate software unrelated to provided functionality, suggesting it is a research-like demonstration.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-08-rc4-secure

Reasons (based on the campaign):

 - Downloads and executes a remote executable.

 - modify-system-without-consent

 - action-hidden-in-lib-usage

## What should I do about MAL-2026-14306?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-14306 is a malicious package: rc4-secure (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-14306/ (Markdown: https://insights.sbomify.com/MAL-2026-14306/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-14306

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-14306/
Summaries are generated and may contain mistakes; the official description above is the record.