{"answers":{"affected":"1 open source package ship an affected version, including pyext6cc8cd.","exploited":"There is no known exploitation of MAL-2026-6488 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6488 is a malicious package in pyext6cc8cd, published on 25 Jun 2026."},"fix_prompt":"MAL-2026-6488 is a malicious package: pyext6cc8cd (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6488/ (Markdown: https://insights.sbomify.com/MAL-2026-6488/index.md)","id":"MAL-2026-6488","markdown":"https://insights.sbomify.com/MAL-2026-6488/index.md","name":"MAL-2026-6488","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"On `pip install`, setup.py decodes a hex string via `bytes.fromhex(\"6f70656e202d612043616c63756c61746f72\").decode().split()` to the argv `open -a Calculator` and executes it through `subprocess.Popen` before `setuptools.setup()` is called. The command runs unconditionally as part of the install lifecycle. The package metadata is placeholder (Author, Home-page, and Description are all 'UNKNOWN') and the package ships no functional code, so this is a proof-of-concept / test artifact demonstrating arbitrary install-time command execution. While the decoded payload here only opens macOS Calculator, the hex obfuscation of the argv is a deliberate technique to evade scanners that grep setup.py for literal command strings, and the same primitive trivially swaps to a destructive or exfiltration payload. Installers should treat this version as untrusted install-time code execution.","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in pyext6cc8cd (PyPI)","id":"MAL-2026-6488","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"pyext6cc8cd","purl":"pkg:pypi/pyext6cc8cd","source":"MAL-2026-6488"}],"products":null,"published":"2026-06-25","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6488/"}