pyjstat-smooth

Details

**Severity:** Critical

**Affected versions:** `= 1.5.0`

## Source: kam193 (82a12638b869aecb566588c24c0f59c3137f9b89a26ae67222370249a7176a75)
The package hides code to exfiltrate specific files from the user's machine. The used file paths suggest it was intended to be used in a CTF-like environment.


---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.


Campaign: 2026-09-pyjstat-smooth


Reasons (based on the campaign):


 - files-exfiltration


 - obfuscation


 - targetted-attack


 - clones-real-package

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/98e0682b1ced0f25d3f708372eccfe333b333544/osv/malicious/pypi/pyjstat-smooth/MAL-2026-16267.json))

**References:**
- https://bad-packages.kam193.eu/pypi/package/pyjstat-smooth
- https://github.com/ghostway0/pyjstat
- https://github.com/ossf/malicious-packages/blob/98e0682b1ced0f25d3f708372eccfe333b333544/osv/malicious/pypi/pyjstat-smooth/MAL-2026-16267.json
- https://github.com/xor34/pyjstat
- https://github.com/ossf/malicious-packages/blob/44c218ef24cf0a946ee5662e20e1cd59a1e6a7b6/osv/malicious/pypi/pyjstat-smooth/MAL-2026-16267.json
- https://pypi.org/project/pyjstat-smooth/2.5.13
- https://pypi.org/project/pyjstat-smooth/2.5.14
- https://pypi.org/project/pyjstat-smooth/2.5.15

Compromised versions (1)

• = 1.5.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.