ml2000

GHSA-hxrc-3x4p-hrm9

Malicious code in ml2000 (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.1.4`

## Source: amazon-inspector (871b57a598bf1230a64fa6ee85d442eb30f21915176835801871dc46c59cedf6)
On invoking the `ml2000` CLI with no arguments, `interactive_menu()` in `src/ml_labs/generator.py` writes a batch file and launches it via `subprocess.Popen(["cmd.exe", "/c", bat_path], creationflags=DETACHED_PROCESS | CREATE_NO_WINDOW)`. The batch script runs `taskkill /IM WindowsTerminal.exe /F`, `taskkill /IM cmd.exe /F`, `taskkill /IM powershell.exe /F`, then `pipx uninstall ml2000`, then deletes itself. The use of detached/no-window flags hides this from the user, and the README advertises only ML notebook code generation — the destructive behavior is undisclosed. This is install/use-time destruction of installer-side resources: open terminal sessions are force-killed (causing loss of unsaved work in any other shell the user has open) and the package removes itself behind the user's back. Project metadata is also placeholder (`Your Name <[email protected]>`), corroborating that this is not a legitimate maintained release.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/ml2000/MAL-2026-4756.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/ml2000/MAL-2026-4756.json
- https://pypi.org/project/ml2000/0.1.4
- https://github.com/advisories/GHSA-hxrc-3x4p-hrm9

Compromised versions (1)

= 0.1.4

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.