MAL-2026-5151 Malicious code in parsimonius (PyPI)
- Package
- parsimonius
- Registry
- PyPI
What is MAL-2026-5151?
MAL-2026-5151 is a malicious package in parsimonius, published on 2 Jun 2026.
Official description
Clone of a legitimate package with an added RAT running through a Telegram bot. It can e.g. exfiltrate env variables and execute remote commands. The malicious action does not start if the geolocation or timezone suggests a Russian area.
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-06-parsimonius
Reasons (based on the campaign):
typosquatting
exfiltration-env-variables
The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
rat
clones-real-package
abuses-pth
geo-restricted
uses-telegram-bot
What should I do about MAL-2026-5151?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.