mypypipkg

GHSA-r2ph-qj6j-8whc

Malicious code in mypypipkg (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 0.1.0`

## Source: kam193 (a94a9bbd6a292f754fedd6ae737eaf5259925cf382a610c9d63e9d210a3f3677)
When running as a module, the package starts a VSCode tunnel and exfiltrates the connection link to the hardcoded target. This lets the attacker connect the VSCode instance online and gain remote access to the machine as the user running the code.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-04-old-mypypipkg


Reasons (based on the campaign):


 - vscode-tunnel

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/mypypipkg/MAL-2026-3105.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/mypypipkg
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/mypypipkg/MAL-2026-3105.json
- https://github.com/advisories/GHSA-r2ph-qj6j-8whc

Compromised versions (1)

= 0.1.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.