{"answers":{"affected":"1 open source package ship an affected version, including netweavex.","exploited":"There is no known exploitation of MAL-2026-18328 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-18328 is a malicious package in netweavex, published on 26 Oct 2026."},"fix_prompt":"MAL-2026-18328 is a malicious package: netweavex (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-18328/ (Markdown: https://insights.sbomify.com/MAL-2026-18328/index.md)","id":"MAL-2026-18328","markdown":"https://insights.sbomify.com/MAL-2026-18328/index.md","name":"MAL-2026-18328","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"netweavex is a typosquat of the popular NetworkX library, reusing its public API, module layout, and README examples (including the `import netweavex as nx` idiom) under a lookalike name. On `import netweavex`, the top-level __init__.py loads netweavex.netweavex, whose module scope invokes exec() on a payload produced by reversing a string literal, base64-decoding it, and zlib-decompressing it (the decoded header is a valid zlib stream, `x\\xda...`). This causes attacker-controlled, opaque bytecode to run on the installer's host at import time. A graph library has no legitimate reason to layer reverse+base64+zlib obfuscation around an exec() sink; the combination of lookalike name, API cloning, and import-time execution of hidden code is the canonical PyPI typosquat dropper shape.\n\nClone of a legitimated package. During import package executes obfuscated code that downloads code from a GitHub repository. During analysis, the code was just a placeholder.\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\nCampaign: 2026-10-netweavex\n\nReasons (based on the campaign):\n\n - clones-real-package\n\n - obfuscation\n\n - Downloads and executes a remote malicious script.\n\n - typosquatting","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in netweavex (PyPI)","id":"MAL-2026-18328","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"netweavex","purl":"pkg:pypi/netweavex","source":"MAL-2026-18328"}],"products":null,"published":"2026-10-26","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-18328/"}