MAL-2026-18762: Malicious code in rainbowcolors (PyPI)

Published Nov 8, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: amazon-inspector (c836e6786c8347157c05d664afcc653b445814cf73f36bc2a5157e41528ffbdd) The package advertises itself as an ANSI-color helper but on Windows the first call to any Color method (print/paint/call) downloads an opaque executable (solace.exe) from an anonymous gofile.io file-share URL (https://store-eu-par-12.gofile.io/download/web/a2a60e90-dea4-4c6c-9a02-be5ede78dc08/solace.exe) into %TEMP%\SolaceRuntime and launches it with DETACHEDPROCESS. Before and after the download the module shells out to PowerShell (-NoProfile -ExecutionPolicy Bypass, with CREATENOWINDOW) to call Add-MpPreference -ExclusionPath and -ExclusionProcess for the drop folder and executable, pre-registering Microsoft Defender exclusions to evade antivirus. The fetched binary bears no relation to the advertised color-printing functionality and is retrieved from a mutable anonymous host with no integrity check.

Affected Software

1 affected component

pip/rainbowcolors=0.1.0

Event History

Nov 8, 2026

Advisory Published

via OSV·09:39 AM

Data Sourced

via OSV·09:39 AM

DescriptionAffected Software

Frequently Asked Questions

Which systems are exposed to the observed behavior?

The described payload behavior is specific to Windows. It runs when a Color method such as print, paint, or __call__ is first invoked.

What does exploitation require?

An application must install the package on Windows and invoke a Color method. That invocation triggers the download and launch of solace.exe from the listed anonymous file-sharing URL.

What signs indicate a system may already be affected?

Look for solace.exe and a SolaceRuntime directory under the user's %TEMP% path. Also review Microsoft Defender exclusions for the SolaceRuntime folder or solace.exe, as the package attempts to add both.

What can be done if the package cannot be removed immediately?

Avoid invoking any Color methods, including print, paint, and __call__, on Windows. Investigate and remove any Defender exclusions and downloaded executable associated with %TEMP%\SolaceRuntime.

MAL-2026-18762: Malicious code in rainbowcolors (PyPI)

Affected Software

Event History

Frequently Asked Questions

Which systems are exposed to the observed behavior?

What does exploitation require?

What signs indicate a system may already be affected?

What can be done if the package cannot be removed immediately?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to the observed behavior?

What does exploitation require?

What signs indicate a system may already be affected?

What can be done if the package cannot be removed immediately?