MAL-2026-18768: Malicious code in super-color (PyPI)

Published Nov 8, 2026

Updated

--- -= Per source details. Do not edit below this line.=-

Source: kam193 (908af2bf828b75158c5bf0aae5a9d422694f21f566a745ff42b82f1f7ed4560d) Package hides a code downloading and installing an infostealer.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-chromacli

Reasons (based on the campaign):

- infostealer

- Downloads and executes a remote executable.

- action-hidden-in-lib-usage

- malware

Affected Software

1 affected component

pip/super-color=0.1.0, =0.1.1, =0.1.2, =0.1.3

Event History

Nov 8, 2026

Advisory Published

via OSV·12:45 PM

Data Sourced

via OSV·12:45 PM

DescriptionAffected Software

Frequently Asked Questions

What happens if this package is installed and used?

The package hides code that downloads and executes a remote executable, which installs an infostealer.

How can I determine whether an environment is affected?

Check whether the PyPI package named super-color is present in the environment or appears in dependency and installation records. The provided data does not identify affected versions or installation timeframes.

What should I do if the package is found?

Treat the environment as potentially exposed to infostealer activity because the package downloads and executes a remote executable. Remove the package and investigate for downloaded executables and possible credential theft.

MAL-2026-18768: Malicious code in super-color (PyPI)

Affected Software

Event History

Frequently Asked Questions

What happens if this package is installed and used?

How can I determine whether an environment is affected?

What should I do if the package is found?

Company

Resources

Contact

Frequently Asked Questions

What happens if this package is installed and used?

How can I determine whether an environment is affected?

What should I do if the package is found?