mal-2026-16142

{
  "affected": [
    {
      "database_specific": {
        "cwes": [
          {
            "cweId": "CWE-506",
            "description": "The product contains code that appears to be malicious in nature.",
            "name": "Embedded Malicious Code"
          }
        ],
        "indicators": {
          "evidence_files": [
            {
              "path": "python_fork/main.py",
              "sha256": "9b41d818a167786cd623deace02a5bc9cc52682abd60b562f28d6fccecee3178"
            }
          ],
          "package_integrity": [
            {
              "filename": "python_fork-0.1.0-py3-none-any.whl",
              "hashes": {
                "blake2b_256": "d8262caa51663d203cb1814c27469b92b839cd898dfe05ddbfce7dfb1346a9fd",
                "md5": "32313b22ae7129835897b156593c56c1",
                "sha256": "4be839959f96d71a2df7a4b1c48d7866f0e3cdf5f1f581ffd6cfdcf3474e541a"
              }
            },
            {
              "filename": "python_fork-0.1.0.tar.gz",
              "hashes": {
                "blake2b_256": "8f173cee75c536d667415e8ca254915b8ff2043ac95b0cd2bf59a2eaafe8296f",
                "md5": "c152d5b6c9543fca17c3efb2a805f453",
                "sha256": "13a753b6aa92cf8a311b258ffa1b5c984cca0cf39d757402169c7ec87f2e11d9"
              }
            }
          ]
        }
      },
      "package": {
        "ecosystem": "PyPI",
        "name": "python-fork"
      },
      "versions": [
        "0.1.0",
        "0.1.1"
      ]
    }
  ],
  "credits": [
    {
      "contact": [
        "inspector-research@amazon.com"
      ],
      "name": "Amazon Inspector",
      "type": "FINDER"
    },
    {
      "contact": [
        "https://github.com/kam193",
        "https://bad-packages.kam193.eu/"
      ],
      "name": "Kamil Mańkowski (kam193)",
      "type": "REPORTER"
    }
  ],
  "database_specific": {
    "malicious-packages-origins": [
      {
        "id": "pypi/2026-09-python-fork/python-fork",
        "import_time": "2026-09-12T10:15:50.493268624Z",
        "modified_time": "2026-09-12T09:15:57.654803Z",
        "sha256": "0bff88696e931354b786185cde4b21e28c27407203c5733ac31b52b7186c1e78",
        "source": "kam193",
        "versions": [
          "0.1.0",
          "0.1.1"
        ]
      },
      {
        "id": "IN-MAL-2026-020471",
        "import_time": "2026-09-23T05:18:37.076246547Z",
        "modified_time": "2026-09-23T05:12:06Z",
        "sha256": "ccd1d960319085a4aee1c389c4b394bfddd03f3c2af57f4d09bce88f9ad4a66d",
        "source": "amazon-inspector",
        "versions": [
          "0.1.0"
        ]
      }
    ]
  },
  "details": "\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ccd1d960319085a4aee1c389c4b394bfddd03f3c2af57f4d09bce88f9ad4a66d)\nThe package was found to contain malicious code or consuming dependency that contains malicious code\n\n## Source: kam193 (0bff88696e931354b786185cde4b21e28c27407203c5733ac31b52b7186c1e78)\nImporting the module starts a fork bomb, what can lead to destabilizing the system.\n\n\n---\n\nCategory: MALICIOUS - The campaign has clearly malicious intent, like infostealers.\n\n\nCampaign: 2026-09-python-fork\n\n\nReasons (based on the campaign):\n\n\n - other\n",
  "id": "MAL-2026-16142",
  "modified": "2026-09-23T05:20:43.686889150Z",
  "published": "2026-09-12T09:15:57Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://bad-packages.kam193.eu/pypi/package/python-fork"
    },
    {
      "type": "PACKAGE",
      "url": "https://pypi.org/project/python-fork/0.1.0/"
    }
  ],
  "schema_version": "1.7.4",
  "summary": "Malicious code in python-fork (PyPI)"
}