MAL-2026-18767: Malicious code in supercolor-tui (PyPI)

Published Nov 8, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: kam193 (9798fa32337256d29d4b551193b6aa6817601034ce787bae4d09d7d6636d813b) Package hides a code downloading and installing an infostealer.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-chromacli

Reasons (based on the campaign):

- Downloads and executes a remote executable.

- malware

- infostealer

- action-hidden-in-lib-usage

Affected Software

1 affected component

pip/supercolor-tui=0.1.0, =0.1.1, =0.1.2, =0.1.4

Event History

Nov 8, 2026

Advisory Published

via OSV·11:31 AM

Data Sourced

via OSV·11:31 AM

DescriptionAffected Software

Frequently Asked Questions

What does the package do when installed or used?

The package hides behavior that downloads and executes a remote executable, which installs an infostealer. The malicious action is concealed in normal library usage.

Who is exposed to this threat?

Users or environments that install and use the PyPI package supercolor-tui are exposed to the hidden downloader behavior described in the report.

How can I determine whether this affects my environment?

Check whether supercolor-tui is present in your Python dependencies or has been installed through pip. If it was installed and used, treat the environment as potentially exposed because the package can download and execute a remote executable.

MAL-2026-18767: Malicious code in supercolor-tui (PyPI)

Affected Software

Event History

Frequently Asked Questions

What does the package do when installed or used?

Who is exposed to this threat?

How can I determine whether this affects my environment?

Company

Resources

Contact

Frequently Asked Questions

What does the package do when installed or used?

Who is exposed to this threat?

How can I determine whether this affects my environment?