MAL-2026-19203: Malicious code in fetchium (PyPI)
--- -= Per source details. Do not edit below this line.=-
Source: kam193 (5b286fc27984ad73cb490d8c5e92be039af62676f22a75c500c2090e137c318b) During import package runs an embedded malicious executable.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-11-fetchium
Reasons (based on the campaign):
- obfuscation
- The package contains code to detect if it is running in a sandbox environment.
- malware
- persistence
- peristence-autorun
Affected Software
Event History
Frequently Asked Questions
When does the malicious behavior execute?
The embedded malicious executable runs when the package is imported. Systems that import fetchium are therefore exposed even if they do not explicitly invoke a separate package function.
What malicious capabilities are indicated?
The package is associated with sandbox-environment detection and persistence through autorun. The campaign is categorized as clearly malicious and includes infostealer-like activity.