MAL-2026-18771: Malicious code in extrahtml (PyPI)

--- -= Per source details. Do not edit below this line.=-

Source: kam193 (f004357dd044b3c2c644a1f759dcd47a154a37533635280af0f3b5adb76469a4) In this campaign, remote code is executed via a dependency pretending to be a YAML loader but embedding a special loader executing code from a provided file. During analysis, the code was just a stub.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-parseyaml

Reasons (based on the campaign):

- The malicious code is intentionally included in a dependency of the package

- Downloads and executes a remote malicious script.