{"answers":{"affected":"1 open source package ship an affected version, including extra-huggingface.","exploited":"There is no known exploitation of MAL-2026-6489 in the wild and no public exploit code.","fix":"Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.","what":"MAL-2026-6489 is a malicious package in extra-huggingface, published on 25 Jun 2026."},"fix_prompt":"MAL-2026-6489 is a malicious package: extra-huggingface (PyPI). Every version was published to cause harm.\n\nTask:\n1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.\n2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.\n3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.\n4. If the package is not used anywhere, say so and change nothing.\n\nReference: https://insights.sbomify.com/MAL-2026-6489/ (Markdown: https://insights.sbomify.com/MAL-2026-6489/index.md)","id":"MAL-2026-6489","markdown":"https://insights.sbomify.com/MAL-2026-6489/index.md","name":"MAL-2026-6489","record":{"aliases":[],"analysis":null,"analysis_generated_by":null,"assigner":null,"cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"The package presents itself as part of the Hugging Face ecosystem but actually ships a remote-access agent. `extra_huggingface/__init__.py` re-exports `run_agent`, `run_task`, `agent_info`, and a `persistence` primitive from a bundled 8.5 MB Windows PE module `extra_huggingface/_native.pyd`. The CLI hardcodes `DEFAULT_SERVER = \"http://91.92.40.212:8080\"` and provides subcommands `run`, `install-autostart`, `remove-autostart`, and `autostart-status`. When invoked, `run_agent(server=...)` polls the attacker-controlled server at 91.92.40.212:8080 and dispatches tasks delivered by that server on the installer's machine; `install_autostart()` calls the native `persistence(\"install\", server)` to register the agent for execution after login/boot so the C2 connection survives reboot. The actual networking, command dispatch, and persistence logic live in the opaque native binary, with the Python layer acting as a thin shim. The package name impersonates the popular `huggingface`/`huggingface_hub` namespace while the metadata homepage is the placeholder `github.com/example/extra_huggingface`, consistent with a typosquat lure targeting ML developers.\n\nWhen starting the module, package activates RAT-capabilities, which includes exfiltrating sensitive data. Though the package is claimed to be for educational usage, the name and default actions suggest different intentions.\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\nCampaign: 2026-06-extra-huggingface\n\nReasons (based on the campaign):\n\n - rat\n\n - exfiltration-browser-data\n\n - typosquatting\n\n - native-extension\n\n - persistence\n\n - infostealer","ecosystems":["PyPI"],"exploits":{"exploitdb":null,"first_seen":null,"github_poc":null,"max_poc_stars":null,"metasploit":null,"nuclei":null,"refs":[],"tier":null},"has_fix":false,"headline":"Malicious code in extra-huggingface (PyPI)","id":"MAL-2026-6489","indexable":true,"kev":null,"kind":"malicious","links":{"ecosystem":"PyPI","product":null,"products":[],"type":null,"year":"2026"},"n_packages":1,"n_references":null,"packages":[{"ecosystem":"PyPI","fixed":[],"introduced":[],"last_affected":[],"package":"extra-huggingface","purl":"pkg:pypi/extra-huggingface","source":"MAL-2026-6489"}],"products":null,"published":"2026-06-25","related":[],"sources":[{"class":"attribution","licence":"Apache-2.0","name":"OpenSSF Malicious Packages","prefix":"MAL"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":null,"updated":null,"vendors":null},"summary":null,"url":"https://insights.sbomify.com/MAL-2026-6489/"}