Threats Tagged 'mal-2026-5876'

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (14f3eeecfabfcb249c5f6ec2a20824355ac313ab18c677334076ca9501607ec8) At install time, setup.py invokes install_sitecustomize(), which copies src/temp_development_package_test/setup/sitecustomize.py into Python's purelib site-packages directory as sitecustomize.py (setup.py:34 destination = site_packages / "sitecustomize.py"; setup.py:36 shutil.copy2(source, destination)). Python auto-imports sitecustomize on every interpreter startup, so this places an interpreter-wide hook outside the package's own namespace that fires for every subsequent Python process on the host — a classic persistence mechanism. The hook payload file is not actually shipped in this 0.2 sdist, so the install would currently raise FileNotFoundError, but the install-time mechanism and intent to write a global hook are unambiguous. The package metadata corroborates a throwaway / probe release: name, author, and summary are all the literal placeholder 'temp_development_package_test'; setup.py imports base64 but never uses it; cli.py imports from an unrelated, undeclared module 'pg_agent.orchestration.coordinator'. The combination — placeholder identity plus install-time write of a global interpreter hook — is not a legitimate package shape. ## Source: kam193 (5cdc1d94dd0cfb62a4a0267ae52bf1a72dfa31a6854196b4bb220759b7c6e878) Starting with version 0.4, package installs a sitecustomize.py that executes during Python engine initialization. The embeded code uses mshta to download malicious code, as in other packages from the campaign. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-easyaillm Reasons (based on the campaign): - Downloads and executes a remote executable. - obfuscation - malware - tool:mshta