MAL-2026-6758: Malicious code in httpprobe (PyPI)
The PyPI package 'httpprobe' version 1.0.0 contains malicious code that attempts to download and execute a remote executable described as a Mirai agent. The package overrides the install command in setup.py to run this malicious code during installation. Although the remote executable was not available during analysis, the use of Onion routing and localhost fallback indicates preparation for malicious activity. This package poses a direct threat by executing unauthorized code on the user's system.
AI Analysis
Technical Summary
The 'httpprobe' PyPI package version 1.0.0 is identified as malicious due to its behavior of downloading and executing a remote executable during installation and when run as a module. The executable is described as a Mirai agent, suggesting botnet-related functionality. The package overrides the standard installation process (setup.py install command) to trigger this behavior. At the time of analysis, the remote payload was inaccessible, implying the attack was not fully operational. This package is part of a malicious campaign labeled 2026-07-httpprobe and is categorized as a malicious package with clear intent to compromise systems.
Potential Impact
Installation or execution of the 'httpprobe' package version 1.0.0 can lead to unauthorized code execution on the affected system. The malicious payload is designed to act as a Mirai agent, which typically involves participation in botnets, potentially leading to system compromise, resource abuse, or further propagation of malware. Even though the remote executable was unavailable during analysis, the package's behavior indicates a high risk of infection and system control if the payload becomes accessible.
Mitigation Recommendations
Avoid installing or using the 'httpprobe' package version 1.0.0 from PyPI. Since no official patch or remediation is available and the package is malicious by design, the best mitigation is to remove any installations of this package and block its use in development and production environments. Monitor package sources carefully and prefer verified and trusted packages. There is no vendor advisory or official fix; therefore, remediation involves avoiding the package entirely.
MAL-2026-6758: Malicious code in httpprobe (PyPI)
Description
The PyPI package 'httpprobe' version 1.0.0 contains malicious code that attempts to download and execute a remote executable described as a Mirai agent. The package overrides the install command in setup.py to run this malicious code during installation. Although the remote executable was not available during analysis, the use of Onion routing and localhost fallback indicates preparation for malicious activity. This package poses a direct threat by executing unauthorized code on the user's system.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The 'httpprobe' PyPI package version 1.0.0 is identified as malicious due to its behavior of downloading and executing a remote executable during installation and when run as a module. The executable is described as a Mirai agent, suggesting botnet-related functionality. The package overrides the standard installation process (setup.py install command) to trigger this behavior. At the time of analysis, the remote payload was inaccessible, implying the attack was not fully operational. This package is part of a malicious campaign labeled 2026-07-httpprobe and is categorized as a malicious package with clear intent to compromise systems.
Potential Impact
Installation or execution of the 'httpprobe' package version 1.0.0 can lead to unauthorized code execution on the affected system. The malicious payload is designed to act as a Mirai agent, which typically involves participation in botnets, potentially leading to system compromise, resource abuse, or further propagation of malware. Even though the remote executable was unavailable during analysis, the package's behavior indicates a high risk of infection and system control if the payload becomes accessible.
Mitigation Recommendations
Avoid installing or using the 'httpprobe' package version 1.0.0 from PyPI. Since no official patch or remediation is available and the package is malicious by design, the best mitigation is to remove any installations of this package and block its use in development and production environments. Monitor package sources carefully and prefer verified and trusted packages. There is no vendor advisory or official fix; therefore, remediation involves avoiding the package entirely.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6758
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a498a6f27e9c7971936e3ff
Added to database: 07/04/2026, 22:34:23 UTC
Last enriched: 07/04/2026, 22:36:55 UTC
Last updated: 07/04/2026, 22:37:06 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.