MAL-2026-855 Malicious code in config-toolkit (PyPI)
- Package
- config-toolkit
- Registry
- PyPI
What is MAL-2026-855?
MAL-2026-855 is a malicious package in config-toolkit, published on 11 Feb 2026.
Official description
During installation, package installs a script that listens for remote commands and executes them. The script is also added to autostart configuration and disguised as system application
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-02-devtools-webhook-cicd-utils
Reasons (based on the campaign):
The package overrides the install command in setup.py to execute malicious code during installation.
peristence-autorun
The package contains code to execute remote commands (probably limited to a specific set) on the victim's machine.
obfuscation
What should I do about MAL-2026-855?
Remove the package from your dependencies and lockfiles, then rotate any secrets on machines where it was installed.