MAL-2026-15863 Malicious code in uvhttp-custom (PyPI)

setup.py contains an obfuscated payload of the form (lambda __: exec(__import__('base64').b64decode('...').decode()))(None) alongside an otherwise-benign setuptools import. The decoded payload writes a bundled script.ps1 to disk and invokes powershell -ExecutionPolicy Bypass -File script.ps1. The PowerShell script uses System.Net.WebClient.DownloadFile to fetch a Windows executable from cdn.discordapp.com/attachments/1532996358427115552/1539384056284717066/enlisted_launcher_1.0.3.190-movn8hpfe.exe into %TEMP%\file.exe and launches it via Start-Process with -WindowStyle Hidden. No hash or signature verification is performed. The payload also invokes os.system("calc"). Running pip install uvhttp-custom on Windows therefore causes the installer's machine to download and silently execute an opaque, unsigned binary from an anonymous Discord CDN URL.

During installation, obfuscated code downloads and executes an executable. It appears to be a game launcher.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-uvhttp-custom

Reasons (based on the campaign):

• The package overrides the install command in setup.py to execute malicious code during installation.

• Downloads and executes a remote executable.

• obfuscation