MAL-2026-3431 Malicious code in apkeep (PyPI)

The package pretends to be a fork of a legitimate Rust library and uses the identity of the original authors. During usage, the obfuscated code targets information held by Kanji/Iru security tools and exfiltrates basic informations to typosquated domain.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-apkeep

Reasons (based on the campaign):

• The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.

• obfuscation

• impersonation

• action-hidden-in-lib-usage