MAL-2026-16131 Malicious code in aitextutils-py (PyPI)

The package was found to contain malicious code or consuming dependency that contains malicious code

This package executes code from malicious dependency, which hides code downloading script, which then downloads and executes a heavily obfuscated final stage. The remote stages are hosted on a domain presenting a suspicious-looking corporate website. The downloaded code establishes persistence e.g. as "anymeetly-cameradriver" systemd service.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-aitextkit-py

Reasons (based on the campaign):

• obfuscation

• Downloads and executes a remote malicious script.

• persistence

• infostealer

• exfiltration-browser-data

• rat

• The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.