MAL-2026-16128 Malicious code in pymem-win (PyPI)

Pymem-win is a near-verbatim copy of the legitimate upstream Pymem package (reusing its description, repository URL github.com/srounet/Pymem, and author identity Fabien Reboia <[email protected]>) republished under a confusable name. The top-level pymem/init.py contains a one-line loader that reverses a bytes literal, base64-decodes it, zlib-decompresses it, and passes the result to exec(). This runs unconditionally on import pymem, handing full in-process code execution to a payload deliberately hidden behind three stacked transforms. The multi-layer obfuscation around an exec target has no legitimate purpose in a library import path; combined with the typosquat cover story that reuses the upstream author's identity, the package's function on install/import is to run attacker-chosen code inside any process that imports it.

During import, the obfuscated code downloads and executes an executable. The remote executable did not exist during analysis, but the repository used to host it overlaps with previous campaign 2026-07-yt-api-dlp

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-pymem-win

Reasons (based on the campaign):

• obfuscation

• Downloads and executes a remote executable.

• clones-real-package