# MAL-2026-3696: Malicious code in projz-py (PyPI)


- **Type:** Malicious package
- **Package:** `projz-py` (PyPI)
- **Published:** 12 May 2026

## What is MAL-2026-3696?

MAL-2026-3696 is a malicious package in projz-py, published on 12 May 2026. 

### Official description

The package routes authentication-related calls through a hardcoded third-party HTTP endpoint and then unpickles the server's raw response, which is a textbook unauthenticated remote code execution primitive against the installer's Python process. Specifically, projz/api/control/rpc.py sets RPC_SERVER = 'http://deepthreads.ru' (plain HTTP) and implements _rpc as: pickle.dumps(args) → session.post(...) → pickle.loads(response.read()). This path is reached from projz/api/request_manager.py (build_headers calls provider.generate_request_signature) and from projz/client.py during registration (RPC.generate_smid), meaning normal documented use of the library drives pickle.loads on attacker-influenceable bytes. Anyone who controls that domain — or any network position on a plain-HTTP path — can execute arbitrary code in the process that imported projz. Compounding the risk, projz/api/secret/__init__.py opens a sibling secret.pyc, skips the 16-byte header, marshal.loads the code object and exec()s it at import time into a synthetic `secret_functions` module; headers_provider.py imports this at the top of the import graph, so the hidden bytecode runs on `import projz`. The.pyc is not present in the sdist, defeating source review of the code that actually builds request signatures and device IDs. The Termux-gated `pkg install sox -y` in setup.py is a minor additional concern (install-time mutation of system package state conditional on an environment marker) but is not the basis for this verdict.

## What should I do about MAL-2026-3696?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-3696 is a malicious package: projz-py (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-3696/ (Markdown: https://insights.sbomify.com/MAL-2026-3696/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-3696

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-3696/
Summaries are generated and may contain mistakes; the official description above is the record.