poly-check-b

GHSA-3324-42r3-w6mm

Malicious code in poly-check-b (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: kam193 (0e03276b0825e5aa683a1edd8c9a7f9947888cd03cde8c5351895a0fa3c2fba6)
During installation, the package attempts to silently execute code. In analyzed versions, the payload file was missing.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-09-snap-queue


Reasons (based on the campaign):


 - The package overrides the install command in setup.py to execute malicious code during installation.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/98184612bbc0219d073872337a937d0c7aeb7b68/osv/malicious/pypi/poly-check-b/MAL-2026-16407.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/poly-check-b
- https://github.com/ossf/malicious-packages/blob/98184612bbc0219d073872337a937d0c7aeb7b68/osv/malicious/pypi/poly-check-b/MAL-2026-16407.json
- https://github.com/advisories/GHSA-3324-42r3-w6mm

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.