MAL-2026-6945: Malicious code in jsonschemavalidation (PyPI)
The jsonschemavalidation package version 4.26.0 on PyPI is a malicious clone of a legitimate package containing embedded reverse shell code. This reverse shell allows an attacker to execute arbitrary commands on the victim's machine. The published version connects to a private IP address, indicating it may not have been fully weaponized at the time of discovery. The package uses obfuscation techniques and is categorized as a malicious package with clear intent to compromise systems.
AI Analysis
Technical Summary
The jsonschemavalidation package version 4.26.0 is identified as a malicious clone of a legitimate PyPI package. It contains embedded reverse shell code that enables remote command execution by an attacker. The reverse shell in the published version connects to a private IP address, suggesting incomplete weaponization. The package also employs obfuscation to hide its malicious functionality. This threat is categorized under a campaign with clear malicious intent, such as information stealing or remote control.
Potential Impact
If installed, this malicious package allows an attacker to gain remote command execution capabilities on the affected system via the embedded reverse shell. This can lead to full system compromise, data theft, or further malicious activities. The presence of obfuscation complicates detection and analysis.
Mitigation Recommendations
No official patch or remediation is available for this malicious package. The recommended mitigation is to avoid installing jsonschemavalidation version 4.26.0 from PyPI. Users should verify package authenticity before installation and rely on official, trusted sources. Remove any installations of this package immediately if found.
MAL-2026-6945: Malicious code in jsonschemavalidation (PyPI)
Description
The jsonschemavalidation package version 4.26.0 on PyPI is a malicious clone of a legitimate package containing embedded reverse shell code. This reverse shell allows an attacker to execute arbitrary commands on the victim's machine. The published version connects to a private IP address, indicating it may not have been fully weaponized at the time of discovery. The package uses obfuscation techniques and is categorized as a malicious package with clear intent to compromise systems.
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The jsonschemavalidation package version 4.26.0 is identified as a malicious clone of a legitimate PyPI package. It contains embedded reverse shell code that enables remote command execution by an attacker. The reverse shell in the published version connects to a private IP address, suggesting incomplete weaponization. The package also employs obfuscation to hide its malicious functionality. This threat is categorized under a campaign with clear malicious intent, such as information stealing or remote control.
Potential Impact
If installed, this malicious package allows an attacker to gain remote command execution capabilities on the affected system via the embedded reverse shell. This can lead to full system compromise, data theft, or further malicious activities. The presence of obfuscation complicates detection and analysis.
Mitigation Recommendations
No official patch or remediation is available for this malicious package. The recommended mitigation is to avoid installing jsonschemavalidation version 4.26.0 from PyPI. Users should verify package authenticity before installation and rely on official, trusted sources. Remove any installations of this package immediately if found.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-6945
- Osv Schema Version
- 1.7.4
- Aliases
- []
- Ecosystems
- ["PyPI"]
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a4e4f16c9d9e3dbe328e799
Added to database: 07/08/2026, 13:22:30 UTC
Last enriched: 07/08/2026, 13:54:45 UTC
Last updated: 07/08/2026, 13:54:45 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.