Malicious code in python-fork (PyPI)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (0bff88696e931354b786185cde4b21e28c27407203c5733ac31b52b7186c1e78) Importing the module starts a fork bomb, what can lead to destabilizing the system. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-python-fork Reasons (based on the campaign): - other
AI Analysis
Technical Summary
The python-fork package versions 0.1.0 and 0.1.1 include code that, when imported, initiates a fork bomb. A fork bomb rapidly creates processes to exhaust system resources, leading to system instability or denial of service. This is a deliberate malicious action embedded in the package, identified as part of a campaign named 2026-09-python-fork. No CVSS score is provided, and no known exploits in the wild are reported.
Potential Impact
Importing the affected python-fork package versions can cause a fork bomb, which may destabilize or crash the host system by exhausting process resources. This can result in denial of service and potential disruption of operations on the affected machine.
Mitigation Recommendations
Users should avoid installing or importing the python-fork package versions 0.1.0 and 0.1.1. Since this is a malicious package, removal of these versions from environments and blocking their installation is recommended. No official patch or fix is indicated; remediation involves not using the affected package versions.
Malicious code in python-fork (PyPI)
Description
--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (0bff88696e931354b786185cde4b21e28c27407203c5733ac31b52b7186c1e78) Importing the module starts a fork bomb, what can lead to destabilizing the system. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-09-python-fork Reasons (based on the campaign): - other
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The python-fork package versions 0.1.0 and 0.1.1 include code that, when imported, initiates a fork bomb. A fork bomb rapidly creates processes to exhaust system resources, leading to system instability or denial of service. This is a deliberate malicious action embedded in the package, identified as part of a campaign named 2026-09-python-fork. No CVSS score is provided, and no known exploits in the wild are reported.
Potential Impact
Importing the affected python-fork package versions can cause a fork bomb, which may destabilize or crash the host system by exhausting process resources. This can result in denial of service and potential disruption of operations on the affected machine.
Mitigation Recommendations
Users should avoid installing or importing the python-fork package versions 0.1.0 and 0.1.1. Since this is a malicious package, removal of these versions from environments and blocking their installation is recommended. No official patch or fix is indicated; remediation involves not using the affected package versions.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- MAL-2026-16142
- Osv Schema Version
- 1.7.4
- Ecosystems
- ["PyPI"]
Threat ID: 6aa5f00555bf5e2cf5ef7ce3
Added to database: 09/13/2026, 00:36:21 UTC
Last enriched: 09/13/2026, 00:40:09 UTC
Last updated: 09/13/2026, 03:15:05 UTC
Views: 7
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.