# MAL-2026-4814: Malicious code in vectordb-engine (PyPI)


- **Type:** Malicious package
- **Package:** `vectordb-engine` (PyPI)
- **Published:** 26 May 2026

## What is MAL-2026-4814?

MAL-2026-4814 is a malicious package in vectordb-engine, published on 26 May 2026. 

### Official description

During `pip install`, a custom `build_ext` step in `src/vectordb_engine_build.py` runs an obfuscated payload that performs targeted reconnaissance and exfiltration. Before doing anything else, it SHA-256-hashes the lowercased machine hostname against an obfuscated salt and compares the digest against three hardcoded allowed-hash constants; if the hostname does not match, the process calls `exit()` — the canonical shape of a targeted supply-chain implant that lies dormant on non-victim machines. On matching hosts, the script collects hostname, FQDN, OS, architecture, Python version, and OS username, concatenates them with `|` separators, XOR-encrypts the blob with a hardcoded key, hex-encodes the result, and issues an HTTPS GET to `https://vectordbengine.blob.core.windows.net/kernels/?v=<encoded-fingerprint>`. A separate function reads environment variables whose names are concealed behind a base85+XOR+zlib decoder (`_ORQFVrfoaIJyX4SjOvpEI`) and folds the values into the same exfil pipeline, consistent with scraping CI/cloud secrets without leaving readable identifiers in the source. `urllib3.disable_warnings()` is invoked to suppress TLS warnings. The package metadata uses placeholder publisher identity (`VectorDB Contributors`, `support@vectordb-engine.io`) and constructs a cover-story URL `https://releases.vectordb-engine.io/kernels` that is built into a string but never actually requested — it exists only as a decoy alongside the real Azure blob exfil endpoint. Each of (hostname-allowlist gating with `exit()` fallback, obfuscated env-var-name scraper feeding a network exfil, host-fingerprint XOR-encoded into a query string against attacker-controlled storage, decoy-domain cover story with placeholder publisher metadata) is independently sufficient evidence of a targeted attack; their joint presence leaves no benign interpretation.

During installation, in the build step, the code performs machine fingerprinting and only in a highly targeted environment, downloads a likely-malicious shared library. The code seems to actually be incomplete.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-05-vectordb-engine

Reasons (based on the campaign):

 - Downloads and executes a remote executable.

 - targetted-attack

 - obfuscation

## What should I do about MAL-2026-4814?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-4814 is a malicious package: vectordb-engine (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-4814/ (Markdown: https://insights.sbomify.com/MAL-2026-4814/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-4814

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-4814/
Summaries are generated and may contain mistakes; the official description above is the record.