MAL-2026-18772: Malicious code in parseyaml (PyPI)

--- -= Per source details. Do not edit below this line.=-

Source: kam193 (21f0c643e1ed1b11c56bfdd5f7567b2c0172924c227206b8ab9e4210918c6ee3) In this campaign, remote code is executed via a dependency pretending to be a YAML loader but embedding a special loader executing code from a provided file. During analysis, the code was just a stub.

---

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-11-parseyaml

Reasons (based on the campaign):

- The malicious code is intentionally included in a dependency of the package

- Downloads and executes a remote malicious script.