MAL-2026-163 Malicious code in do-not-install-this-package-002 (PyPI)

During installation, the package exfiltrates env variables and data from different process memory to a remote location

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-01-do-not-install-this-package-002

Reasons (based on the campaign):

• exfiltration-generic

• exfiltration-credentials

• exfiltration-env-variables

• The package overrides the install command in setup.py to execute malicious code during installation.

The OpenSSF Package Analysis project identified 'do-not-install-this-package-002' @ 0.1.0 (pypi) as malicious.

It is considered malicious because:

• The package communicates with a domain associated with malicious activity.

• The package executes one or more commands associated with malicious behavior.