# MAL-2026-6489: Malicious code in extra-huggingface (PyPI)


- **Type:** Malicious package
- **Package:** `extra-huggingface` (PyPI)
- **Published:** 25 Jun 2026

## What is MAL-2026-6489?

MAL-2026-6489 is a malicious package in extra-huggingface, published on 25 Jun 2026. 

### Official description

The package presents itself as part of the Hugging Face ecosystem but actually ships a remote-access agent. `extra_huggingface/__init__.py` re-exports `run_agent`, `run_task`, `agent_info`, and a `persistence` primitive from a bundled 8.5 MB Windows PE module `extra_huggingface/_native.pyd`. The CLI hardcodes `DEFAULT_SERVER = "http://91.92.40.212:8080"` and provides subcommands `run`, `install-autostart`, `remove-autostart`, and `autostart-status`. When invoked, `run_agent(server=...)` polls the attacker-controlled server at 91.92.40.212:8080 and dispatches tasks delivered by that server on the installer's machine; `install_autostart()` calls the native `persistence("install", server)` to register the agent for execution after login/boot so the C2 connection survives reboot. The actual networking, command dispatch, and persistence logic live in the opaque native binary, with the Python layer acting as a thin shim. The package name impersonates the popular `huggingface`/`huggingface_hub` namespace while the metadata homepage is the placeholder `github.com/example/extra_huggingface`, consistent with a typosquat lure targeting ML developers.

When starting the module, package activates RAT-capabilities, which includes exfiltrating sensitive data. Though the package is claimed to be for educational usage, the name and default actions suggest different intentions.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-06-extra-huggingface

Reasons (based on the campaign):

 - rat

 - exfiltration-browser-data

 - typosquatting

 - native-extension

 - persistence

 - infostealer

## What should I do about MAL-2026-6489?

Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.

## Fix prompt for AI coding agents

```text
MAL-2026-6489 is a malicious package: extra-huggingface (PyPI). Every version was published to cause harm.

Task:
1. Search this repository's dependency manifests and lockfiles for the package, including transitive dependencies.
2. If it is present, remove it, regenerate the lockfile with the project's package manager, and replace whatever it was used for.
3. List any CI runners, developer machines or containers that installed it, so their secrets can be rotated.
4. If the package is not used anywhere, say so and change nothing.

Reference: https://insights.sbomify.com/MAL-2026-6489/ (Markdown: https://insights.sbomify.com/MAL-2026-6489/index.md)
```

## Sources

- OSV: https://osv.dev/vulnerability/MAL-2026-6489

---
From sbomify Insights: https://insights.sbomify.com/MAL-2026-6489/
Summaries are generated and may contain mistakes; the official description above is the record.