MAL-2026-19202: Malicious code in dashloom (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (ba0285d49d46cd93cdcad1582bb1c013beb3791dc901a0a3c96f3801dba9d909) This package is prepared to be used as a malicious loader. It pins pydash dependency in a vulnerable version allowing reaching out of the object scope when calling pydash.invoke(...). The code to reach it is intended to be delivered from the now-benign GitHub file, which is then splited and passed to the vulnerable function. The same Github user account is also involved in publishing a repository that executes embedded encrypted code when called with specific arguments. The package was originally flagged by PyPI Security.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-dashloom
Reasons (based on the campaign):
- action-hidden-in-lib-usage
- Downloads and executes a remote malicious script.
Affected Software
Event History
Frequently Asked Questions
Which environments are exposed?
Environments that install the dashloom package from PyPI and execute the relevant code path are exposed. The package is described as a malicious loader that relies on pydash.invoke.
What does exploitation depend on?
The intended path delivers code from a GitHub file, splits it, and passes it to the vulnerable pydash.invoke function. The campaign behavior includes downloading and executing a remote malicious script.
Is the remote source still available for inspection?
The GitHub file used to deliver the code is described as now benign. This may limit direct verification of the originally delivered payload from its current contents.