MAL-2026-18343 Malicious code in numprint (PyPI)

numprint 1.2.0 on PyPI could not be fully characterized from the available signals. No specific installer-harm fingerprint (hardcoded C2, credential path read, home-directory secret scan, install-time fetch-and-execute, dropper, backdoor, self-propagation) is concretely identified in this record. The package name resembles common numeric/printing utility names but no benign purpose is confirmed either.

During installation the package starts a background process executing commands provided by the attacker. The C2 communication happens through a GitHub Gist.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-numprint

Reasons (based on the campaign):

• The package overrides the install command in setup.py to execute malicious code during installation.

• The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.

• rat