queeuees

GHSA-m3mj-98fq-j5r3

Malicious code in queeuees (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.0.1`

## Source: kam193 (1adc88dd9031dc991006afcf10242d1de3aa7994f6bcb4542faed95524d6ebe0)
Obfuscated code iterates over files in the system and adds a comment to every .py file found.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-09-queeuees


Reasons (based on the campaign):


 - obfuscation


 - modify-system-without-consent

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/1fa66229c45e3a6dd673735c281e98120464c409/osv/malicious/pypi/queeuees/MAL-2026-17286.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/queeuees
- https://github.com/ossf/malicious-packages/blob/1fa66229c45e3a6dd673735c281e98120464c409/osv/malicious/pypi/queeuees/MAL-2026-17286.json
- https://github.com/ossf/malicious-packages/blob/018b297d9bd9492d29ff3fdcaba9ca4c79753d55/osv/malicious/pypi/queeuees/MAL-2026-17286.json
- https://pypi.org/project/Queeuees/0.0.1
- https://github.com/advisories/GHSA-m3mj-98fq-j5r3

Compromised versions (1)

= 0.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.