MAL-2026-6248 Malicious code in jsonschema-viewer (PyPI)

The package's only function — main() in src/jsonschema_viewer/main.py, registered as the jsonschema-viewer console script — invokes os.system to fetch a shell script from http://49.232.169.67:8084/slt via curl or wget and pipes the response into sh. The fetch uses plaintext HTTP to a bare IP with no pinning, no hash verification, and an opaque payload, and bears no relationship to the package's advertised purpose ('A minimal jsonschema-viewer package'). Author metadata is the placeholder 'Your Name' with no email/URL and the README is a single empty sentence, consistent with a throwaway dropper package. Any developer who installs this package and runs the documented CLI executes arbitrary attacker-controlled code on their machine.

Package configures an entry point (command line) that executes a remote script. It then downloads a next stage malware, which acts as next dropper for a fileless malware.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-jsonschema-viewer

Reasons (based on the campaign):

• malware

• Downloads and executes a remote executable.

• Downloads and executes a remote malicious script.