index-forum (PyPI) · Malicious Code
Affects index-forumSource GCVE Database
Malicious package : remove index-forum and rotate any secrets on hosts that installed it.
Data as of 23 Sep 2026, 06:21 UTC
Malicious package
Published to PyPI · OSV MAL-2026-16268
What to do
Remove index-forum from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| PyPIindex-forum | Affected
| Fixed in– |
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4b837b7b56f9b239c9d0c86bd2e7d432d3223e496a9820c54b0a14fd3c542b22) The package was found to contain malicious code or consuming dependency that contains malicious code ## Source: kam193 (7561fd94425cdde34f5f9f3d20482a0da8680414d0f38e1e00fea419ce23cf66) The package hides code to exfiltrate specific files from the user's machine. The used file paths suggest it was intended to be used in a CTF-like environment. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-pyjstat-smooth Reasons (based on the campaign): - files-exfiltration - obfuscation - targetted-attack - clones-real-package