index-forum

GHSA-8466-62v8-x2vr

Malicious code in index-forum (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 2.5.4`

## Source: kam193 (7561fd94425cdde34f5f9f3d20482a0da8680414d0f38e1e00fea419ce23cf66)
The package hides code to exfiltrate specific files from the user's machine. The used file paths suggest it was intended to be used in a CTF-like environment.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-09-pyjstat-smooth


Reasons (based on the campaign):


 - files-exfiltration


 - obfuscation


 - targetted-attack


 - clones-real-package

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/744ae1d9c9dd0cb76c8e2d2c8e1a3ba80f10d0de/osv/malicious/pypi/index-forum/MAL-2026-16268.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/index-forum
- https://github.com/ghostway0/pyjstat
- https://github.com/ossf/malicious-packages/blob/744ae1d9c9dd0cb76c8e2d2c8e1a3ba80f10d0de/osv/malicious/pypi/index-forum/MAL-2026-16268.json
- https://github.com/xor34/pyjstat
- https://github.com/ossf/malicious-packages/blob/d9a451cbb73776aade5f2f5ad3ae60f5eb2524ec/osv/malicious/pypi/index-forum/MAL-2026-16268.json
- https://pypi.org/project/index-forum/2.5.4
- https://github.com/advisories/GHSA-8466-62v8-x2vr

Compromised versions (1)

= 2.5.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.