MAL-2026-5756 Malicious code in easyaillm (PyPI)

On pip install easyaillm, setup.py runs exec(base64.b64decode(...)) which decodes to code that fetches https://pastebin.com/raw/hEF5HaFc, treats the response body as a second URL, downloads that URL's bytes to pkg_installer.exe, and executes it via os.system('cmd /c pkg_installer.exe'). The attack stages are concealed behind a base64 blob and exec() indirection, while the package metadata advertises an unrelated LLM/Roblox API purpose as cover. The pastebin source is mutable and anonymous, allowing the operator to swap the second-stage URL and ultimately the executed binary at any time. Installing this package on Windows results in arbitrary attacker-controlled code execution on the installer's machine.

During installation, the obfuscsted code attempts to download and start a malicious executable. The published versions contained issues preventing successful downloading, but it was possible to recover the intended executable during the analysis.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-easyaillm

Reasons (based on the campaign):

• Downloads and executes a remote executable.

• obfuscation

• malware

• tool:mshta