MAL-2026-18222: Malicious code in badgertask (PyPI)

Published Oct 23, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (dec1f79725a3b93471456baaf9c5b4ea9b889270fb5526070a136c1c9e06b08c) Analysis of badgertask 0.1.0 produced no findings indicating installer-side harm. No install-time or import-time network activity, credential or environment scraping, filesystem persistence outside the package's own directory, obfuscated payloads, or outbound connections to attacker-controlled destinations were observed in the shipped files.

Source: kam193 (ad613b4be626131dbf5d5cdd0e6d63ca39c89165c96fe7fd152d8d781c4573ba) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

- other

- Downloads and executes a remote malicious script.

Affected Software

1 affected component

pip/badgertask=0.1.0

Event History

Oct 23, 2026

Advisory Published

via OSV·03:52 PM

Data Sourced

via OSV·03:52 PM

DescriptionAffected Software

Frequently Asked Questions

What does an attacker need to exploit this package?

The package is described as a loader that executes code from a URL. Exploitation therefore depends on the package being used in a way that supplies or causes it to retrieve remote code; the malicious payload is not contained in the package itself.

Does installing or importing version 0.1.0 trigger the reported behavior?

The available analysis found no installer-side harm in version 0.1.0. It observed no install-time or import-time network activity, credential or environment scraping, persistence outside the package directory, obfuscated payloads, or outbound connections to attacker-controlled destinations.

How can I determine whether my environment is exposed?

Check whether badgertask is present in your Python dependencies and whether it is invoked to execute code from a URL. The available information does not identify a specific remote payload or usage pattern beyond its loader behavior.

What should I do if I cannot immediately remove the package?

Avoid using it to retrieve or execute code from URLs. The package is part of a coordinated campaign described as providing deceptive ways to load remote malicious code.

MAL-2026-18222: Malicious code in badgertask (PyPI)

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this package?

Does installing or importing version 0.1.0 trigger the reported behavior?

How can I determine whether my environment is exposed?

What should I do if I cannot immediately remove the package?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this package?

Does installing or importing version 0.1.0 trigger the reported behavior?

How can I determine whether my environment is exposed?

What should I do if I cannot immediately remove the package?