MAL-2026-18658: Malicious code in rcp-ndcg (PyPI)

Published Nov 5, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: ossf-package-analysis (fc78014eaba6dbdc0a485f1954874cbfa65b71ffcda55b1b9337807004e42a2f) The OpenSSF Package Analysis project identified 'rcp-ndcg' @ 9999.0.0 (pypi) as malicious.

It is considered malicious because:

- The package communicates with a domain associated with malicious activity.

Affected Software

1 affected component

pip/rcp-ndcg=9999.0.0

Event History

Nov 5, 2026

Advisory Published

via OSV·03:31 AM

Data Sourced

via OSV·03:31 AM

DescriptionAffected Software

Frequently Asked Questions

Which installations are affected?

The identified malicious release is rcp-ndcg version 9999.0.0 from PyPI. Any environment that installed that package version should be treated as potentially exposed.

What behavior led to the package being classified as malicious?

The package was identified as communicating with a domain associated with malicious activity. The provided data does not specify what information or actions were involved in that communication.

MAL-2026-18658: Malicious code in rcp-ndcg (PyPI)

Affected Software

Event History

Frequently Asked Questions

Which installations are affected?

What behavior led to the package being classified as malicious?

Company

Resources

Contact

Frequently Asked Questions

Which installations are affected?

What behavior led to the package being classified as malicious?