MAL-2026-5766 Malicious code in easyllmai (PyPI)

During pip install, setup.py performs an unauthenticated HTTP fetch of https://pastebin.com/raw/yBcUM1QB, takes the first line of the response, and passes it directly to os.system(f'cmd /c "{cmd_pastebin}"'). The remote content is hosted on an anonymous, mutable, attacker-controlled paste with no pinning, no hash check, and no signature verification. Whoever controls the paste obtains arbitrary command execution on every installer's machine at install time. This is a canonical install-time dropper pattern: lifecycle-time outbound fetch from an unverified source piped straight into the OS shell.

During installation, the code attempts to download and start a malicious executable.

Likely related to 2025-08-raknet-testing-package.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-easyaillm

Reasons (based on the campaign):

• Downloads and executes a remote executable.

• obfuscation

• malware

• tool:mshta