MAL-2026-19051: Malicious code in shanks (PyPI)
The module shanks/shanks.py, when imported, looks up the machine's public IP address and location from a geolocation service and posts the IP address, city, state, postal code, latitude and longitude, with an @everyone mention, to a hard-coded Discord webhook. The package describes itself only as "A small example pkg". Version examined: 0.0.4; sdist SHA-256 dc417305d4b083a60ffda7aa310952306258fc12afc536a0641fc4a79c95bed8.
Affected Software
Event History
Frequently Asked Questions
What information is exposed if this package is imported?
The code collects the machine's public IP address and geolocation data: city, state, postal code, latitude, and longitude. It sends this information to a hard-coded Discord webhook and includes an @everyone mention.
What action triggers the data exfiltration?
The behavior occurs when the shanks/shanks.py module is imported. Systems that install the package but never import that module are not described as triggering the reported behavior.
Which package version and artifact were examined?
The examined version is 0.0.4. The reported source distribution SHA-256 is dc417305d4b083a60ffda7aa310952306258fc12afc536a0641fc4a79c95bed8.