kcvlib

GHSA-rccw-4j5p-mff2

Malicious code in kcvlib (PyPI)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: kam193 (4a441a8e0abdd54964ca9e0a5e3a1d0e0c0435f05d80ab9e9210e10194a16f3d)
During import, the package downloads and executes obfuscated code. It appears to be an infostealer framework


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-04-kcvlib


Reasons (based on the campaign):


 - obfuscation


 - Downloads and executes a remote malicious script.


 - infostealer

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/kcvlib/MAL-2026-3131.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/kcvlib
- https://github.com/ossf/malicious-packages/blob/49d0cfba3689ed9b195d101d3a2a964c6a77f767/osv/malicious/pypi/kcvlib/MAL-2026-3131.json
- https://github.com/ovrlust/cookie-library/tree/985f8b10041887590b65f1ca107e4ac9f85a54dd
- https://github.com/advisories/GHSA-rccw-4j5p-mff2

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.