MAL-2026-2138 Malicious code in open-vp-cal (PyPI)

When executing the module, the code installs a package from a remote location. The remote package contains malicious code exfiltrating selected env variables and selected information from credential files. The code claims to be security research.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-03-open-vp-cal

Reasons (based on the campaign):

• exfiltration-env-variables

• Downloads and executes a remote malicious script.

• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.