Threats Tagged 'mal-2026-17866'

The pyyi package on PyPI is a malicious package that impersonates the Python interpreter and executes remote code supplied by a command-and-control server. It registers console commands named after Python executables (e.g., python3.7) that shadow legitimate interpreters and send system information to an obfuscated server. The package fetches, decodes, decompresses, and executes arbitrary Python code in memory without any integrity checks. It also includes a fake Python REPL that captures single-token inputs as passwords and sends them to the attacker. This combination enables remote code execution and credential theft on affected systems.