# MAL-2026-18328: Malicious code in netweavex (PyPI)


- **Type:** Malicious package
- **Package:** `netweavex` (PyPI)
- **Published:** 26 Oct 2026

## What is MAL-2026-18328?

MAL-2026-18328 is a malicious package in netweavex, published on 26 Oct 2026. 

### Official description

netweavex is a typosquat of the popular NetworkX library, reusing its public API, module layout, and README examples (including the `import netweavex as nx` idiom) under a lookalike name. On `import netweavex`, the top-level __init__.py loads netweavex.netweavex, whose module scope invokes exec() on a payload produced by reversing a string literal, base64-decoding it, and zlib-decompressing it (the decoded header is a valid zlib stream, `x\xda...`). This causes attacker-controlled, opaque bytecode to run on the installer's host at import time. A graph library has no legitimate reason to layer reverse+base64+zlib obfuscation around an exec() sink; the combination of lookalike name, API cloning, and import-time execution of hidden code is the canonical PyPI typosquat dropper shape.

Clone of a legitimated package. During import package executes obfuscated code that downloads code from a GitHub repository. During analysis, the code was just a placeholder.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-netweavex

Reasons (based on the campaign):

 - clones-real-package

 - obfuscation

 - Downloads and executes a remote malicious script.

 - typosquatting

## What should I do about MAL-2026-18328?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-18328 is a malicious package: netweavex (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-18328/ (Markdown: https://insights.sbomify.com/MAL-2026-18328/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-18328

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-18328/
Summaries are generated and may contain mistakes; the official description above is the record.