MAL-2026-870 Malicious code in b10connoisseur (PyPI)

During installation, package attempts to enumerate the environment and exfiltrates potentially sensitive data to a hardcoded location.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-02-b10connoisseur

Reasons (based on the campaign):

• exfiltration-generic

• exfiltration-env-variables

• The package overrides the install command in setup.py to execute malicious code during installation.

The OpenSSF Package Analysis project identified 'b10connoisseur' @ 0.12.0 (pypi) as malicious.

It is considered malicious because:

• The package executes one or more commands associated with malicious behavior.