MAL-2026-18229: Malicious code in juniperrun (PyPI)

Published Oct 23, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (013530dce5f4cdf34262deb2b4b105f7336b0248085fc26b815aa4e932f0cd72) Package juniperrun 0.1.0 on PyPI shows no indicators of installer-side harm in the files scanned. No install-time network activity, no lifecycle hooks fetching or executing remote content, no reads of credential paths (~/.aws, ~/.ssh, ~/.npmrc, ~/.pypirc) or environment scraping, no silent-relay of caller data to a hardcoded destination, and no persistence or backdoor mechanisms are present.

Source: kam193 (1fd79c13a84952cbede2a1b1de7ba5d43396a2c95866015cdf73c9ce0d9960f5) This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

- other

- Downloads and executes a remote malicious script.

Affected Software

1 affected component

pip/juniperrun=0.1.0

Event History

Oct 23, 2026

Advisory Published

via OSV·03:51 PM

Data Sourced

via OSV·03:51 PM

DescriptionAffected Software

Frequently Asked Questions

What does an attacker need to exploit this package?

An attacker would need a user or automated build process to install and use the package in a way that causes it to execute code from a supplied URL. The package is described as a loader that downloads and executes remote script content.

Is there evidence that installation alone compromises a system?

The scanned package files showed no installer-side harm indicators. The scan found no install-time network activity, lifecycle hooks that fetch or execute remote content, credential-path reads, environment scraping, data relay, persistence, or backdoor mechanisms.

Who is most exposed?

Users and build environments that install juniperrun and provide or permit an untrusted URL for its code-loading behavior are the most directly exposed. The described risk is execution of remotely hosted code rather than package-installation behavior alone.

What can be done if the package cannot be removed immediately?

Do not allow the package to retrieve code from untrusted or uncontrolled URLs. Restrict outbound network access for the environment running it and review any configured or supplied URLs for remote scripts.

MAL-2026-18229: Malicious code in juniperrun (PyPI)

Affected Software

Event History

Frequently Asked Questions

What does an attacker need to exploit this package?

Is there evidence that installation alone compromises a system?

Who is most exposed?

What can be done if the package cannot be removed immediately?

Company

Resources

Contact

Frequently Asked Questions

What does an attacker need to exploit this package?

Is there evidence that installation alone compromises a system?

Who is most exposed?

What can be done if the package cannot be removed immediately?