MAL-2026-2109 Malicious code in pyregions-snowflake (PyPI)
- Package
- pyregions-snowflake
- Registry
- PyPI
What is MAL-2026-2109?
MAL-2026-2109 is a malicious package in pyregions-snowflake, published on 23 Mar 2026.
Official description
During installation, the package starts obfuscated code that downloads and runs remote executables in specific environments - in older packages - attempts to exfiltrate some basic information using DNS requests and then likely cover tracks by installing a similarly named package from private repository
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-02-urllib-slim
Reasons (based on the campaign):
typosquatting
Downloads and executes a remote executable.
obfuscation
dependency-confusion
What should I do about MAL-2026-2109?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.