MAL-2026-16408 Malicious code in snap-queue (PyPI)

The sdist's setup.py defines a _wus_boot() function that is invoked at module top-level before setup(...), so it runs automatically on pip install snap-queue. The function uses subprocess.Popen to launch pythonw.exe (replacing python.exe in sys.executable) running a sibling file _snapqueue_core.py with creationflags=0x08000000 (CREATE_NO_WINDOW), and wraps the whole call in a blanket try/except: pass. Standard modules are aliased under underscore names (_os, _sys, _sp) to reduce visual prominence. The launched _snapqueue_core.py is undocumented in README and package metadata and is unrelated to the advertised FIFO-queue functionality. The combined shape — install-time execution, deliberate console-window suppression on Windows, error-swallowing, and detachment of the child from the pip process — is a hidden install-time stager that hands control on the installer's machine to undocumented sibling code the moment the package is installed.

During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-snap-queue

Reasons (based on the campaign):

• The package overrides the install command in setup.py to execute malicious code during installation.